{"record":{"id":"bab9da696f0ead18","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-bab9da","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualityprofile/ws/AddProjectAction.java","lineNumber":124,"sourceCode":"        dbSession.commit();\n      }\n      qualityProfileChangeEventService.publishRuleActivationToSonarLintClients(project, profile, deactivatedProfile);\n    }\n\n    response.noContent();\n  }\n\n  private ProjectDto loadProject(DbSession dbSession, Request request) {\n    String projectKey = request.mandatoryParam(PARAM_PROJECT);\n    return componentFinder.getProjectByKey(dbSession, projectKey);\n  }\n\n  private void checkPermissions(QProfileDto profile, ProjectDto project) {\n    if (wsSupport.canAdministrate(profile) || userSession.hasEntityPermission(ProjectPermission.ADMIN, project)) {\n      return;\n    }\n\n    throw insufficientPrivilegesException();\n  }\n}\n","sourceCodeStart":106,"sourceCodeEnd":127,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualityprofile/ws/AddProjectAction.java#L106-L127","documentation":"api/qualityprofiles/add_project attaches a project to a quality profile. checkPermissions allows the operation only if the user can administrate the profile globally (ADMINISTER_QUALITY_PROFILES) or is a project ADMIN; otherwise it throws insufficientPrivilegesException. This prevents non-admin project users from changing which rule set analyzes their project.","triggerScenarios":"Calling POST api/qualityprofiles/add_project (language+profile+projectKey) as a user who is neither a quality-profile administrator nor an administrator of the target project.","commonSituations":"Developers with project USER access trying to switch their project's profile; automation tokens that lost the global quality-profiles permission; cross-team requests where the caller is admin of a different project.","solutions":["Grant the user project ADMIN permission on the target project.","Or grant global 'Administer Quality Profiles' permission via Administration > Security.","Use an admin/automation token with quality-profiles administration rights.","Check that the profile name and language parameters match an existing, non-built-in profile (built-in profiles also cannot be modified via other checks)."],"exampleFix":"// before: project user tries to attach profile\ncurl -u usertoken: -X POST \"$SONAR/api/qualityprofiles/add_project?language=java&qualityProfile=MyProfile&project=my.project\"\n\n// after: grant project admin first\ncurl -u admintoken: -X POST \"$SONAR/api/permissions/add_user?projectKey=my.project&permission=admin&login=jdoe\"","handlingStrategy":"validation","validationCode":"curl -u \"$TOKEN\": \"$SONAR/api/permissions/users?projectKey=$PROJECT&login=$USER\" | grep '\"permission\":\"admin\"'\ncurl -u \"$TOKEN\": \"$SONAR/api/permissions/user?login=$USER\" | grep 'profileadmin'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only let profile administrators or project admins bind profiles to projects.","Provision CI/automation tokens with 'Administer Quality Profiles' if they manage profiles.","Check profile exists and is not built-in before calling add_project.","Validate parameters (language, qualityProfile, projectKey) before the permission-sensitive call."],"tags":["sonarqube","webapi","authorization","quality-profiles"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}