{"record":{"id":"ba2c1288f6262987","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-ba2c12","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualityprofile/ws/RemoveProjectAction.java","lineNumber":117,"sourceCode":"      }\n\n      qualityProfileChangeEventService.publishRuleActivationToSonarLintClients(project, activatedProfile, profile);\n\n      response.noContent();\n    }\n  }\n\n  private ProjectDto loadProject(DbSession dbSession, Request request) {\n    String projectKey = request.mandatoryParam(PARAM_PROJECT);\n    return componentFinder.getProjectByKey(dbSession, projectKey);\n  }\n\n  private void checkPermissions(QProfileDto profile, ProjectDto project) {\n    if (wsSupport.canAdministrate(profile) || userSession.hasEntityPermission(ProjectPermission.ADMIN, project)) {\n      return;\n    }\n\n    throw insufficientPrivilegesException();\n  }\n}\n","sourceCodeStart":99,"sourceCodeEnd":120,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualityprofile/ws/RemoveProjectAction.java#L99-L120","documentation":"api/qualityprofiles/remove_project detaches a project from a quality profile. checkPermissions mirrors AddProjectAction: the caller must either be able to administrate the profile (quality-profile administration) or hold project ADMIN permission on the target project. Otherwise insufficientPrivilegesException is thrown.","triggerScenarios":"Calling POST api/qualityprofiles/remove_project (language+qualityProfile+projectKey) as a user who is neither a quality-profile administrator nor an admin of the given project.","commonSituations":"Project USER-level developers trying to unlink a profile from their project; cleanup scripts run with a token that only has analysis rights; callers admin of a different project than the one named in projectKey.","solutions":["Grant project ADMIN permission on the target project to the calling user.","Or grant global 'Administer Quality Profiles' permission.","Run the cleanup with an administrator token.","Confirm the projectKey parameter refers to the project the user administers, not a renamed/duplicate key."],"exampleFix":"// before: non-admin tries to detach profile\ncurl -u usertoken: -X POST \"$SONAR/api/qualityprofiles/remove_project?language=java&qualityProfile=TeamProfile&project=my.project\"\n\n// after: grant project admin\ncurl -u admintoken: -X POST \"$SONAR/api/permissions/add_user?projectKey=my.project&permission=admin&login=jdoe\"","handlingStrategy":"validation","validationCode":"curl -u \"$TOKEN\": \"$SONAR/api/permissions/users?projectKey=$PROJECT&login=$USER\" | grep '\"permission\":\"admin\"'\ncurl -u \"$TOKEN\": \"$SONAR/api/permissions/user?login=$USER\" | grep 'profileadmin'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pair add_project and remove_project scripts with the same privileged account.","Confirm project key correctness — permission checks are per-project.","Grant project admin via permission templates to reduce ad-hoc grants.","Document that profile administration also unlocks remove_project."],"tags":["sonarqube","webapi","authorization","quality-profiles"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}