{"record":{"id":"df6deefc05e18bc6","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-df6dee","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualitygate/ws/QualityGatesWsSupport.java","lineNumber":76,"sourceCode":"\n  QualityGateConditionDto getCondition(DbSession dbSession, String uuid) {\n    return checkFound(dbClient.gateConditionDao().selectByUuid(uuid, dbSession), \"No quality gate condition with uuid '%s'\", uuid);\n  }\n\n  boolean isQualityGateAdmin() {\n    return userSession.hasPermission(ADMINISTER_QUALITY_GATES);\n  }\n\n  void checkCanEdit(QualityGateDto qualityGate) {\n    checkNotBuiltIn(qualityGate);\n    userSession.checkPermission(ADMINISTER_QUALITY_GATES);\n  }\n\n  void checkCanLimitedEdit(DbSession dbSession, QualityGateDto qualityGate) {\n    checkNotBuiltIn(qualityGate);\n    if (!userSession.hasPermission(ADMINISTER_QUALITY_GATES)\n      && !hasLimitedPermission(dbSession, qualityGate)) {\n      throw insufficientPrivilegesException();\n    }\n  }\n\n  boolean hasLimitedPermission(DbSession dbSession, QualityGateDto qualityGate) {\n    return userHasPermission(dbSession, qualityGate) || userHasGroupPermission(dbSession, qualityGate);\n  }\n\n  boolean userHasGroupPermission(DbSession dbSession, QualityGateDto qualityGate) {\n    return userSession.isLoggedIn() && dbClient.qualityGateGroupPermissionsDao().exists(dbSession, qualityGate, userSession.getGroups());\n  }\n\n  boolean userHasPermission(DbSession dbSession, QualityGateDto qualityGate) {\n    return userSession.isLoggedIn() && dbClient.qualityGateUserPermissionDao().exists(dbSession, qualityGate.getUuid(), userSession.getUuid());\n  }\n\n\n  void checkCanAdminProject(ProjectDto project) {\n    if (userSession.hasPermission(ADMINISTER_QUALITY_GATES)","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualitygate/ws/QualityGatesWsSupport.java#L58-L94","documentation":"QualityGatesWsSupport.checkCanLimitedEdit guards web services that allow limited modification of a quality gate (e.g., associating projects). The user must either hold the global ADMINISTER_QUALITY_GATES permission or have a user- or group-level editing permission on that specific gate; otherwise insufficientPrivilegesException is thrown. Built-in gates are rejected earlier by checkNotBuiltIn regardless of permissions.","triggerScenarios":"Calling gate-modification web services such as api/qualitygates/create, copy, or association endpoints as a user without global 'Administer Quality Gates' and without per-gate user/group permission (e.g., api/qualitygates/add_user or add_group permission entries for that gate). Also thrown when targeting a built-in gate name is passed (checkNotBuiltIn throws IllegalArgumentException there, not this error).","commonSituations":"Delegated gate admins who were given per-gate permissions later removed; users attempting to edit the built-in 'Sonar way' gate's project associations; permission model migrations after upgrading SonarQube that dropped per-gate grants.","solutions":["Grant the user global 'Administer Quality Gates' permission via Administration > Security > Permission Templates / Global permissions.","Or grant user- or group-level permission on the specific quality gate via api/qualitygates/add_user or api/qualitygates/add_group.","Confirm you are not targeting a built-in gate; built-in gates cannot be edited at all.","If the operation should be admin-only, use a token of a quality-gate administrator."],"exampleFix":"// before: regular user attempts gate edit\ncurl -u usertoken: -X POST \"$SONAR/api/qualitygates/copy?name=Sonar%20way\"\n\n// after: grant per-gate permission first\ncurl -u admintoken: -X POST \"$SONAR/api/qualitygates/add_user?gateName=Sonar%20way&login=jdoe\"","handlingStrategy":"validation","validationCode":"// Built-in gates can never be edited; skip them upfront:\nif (\"Sonar way\".equals(gateName)) throw new IllegalArgumentException(\"Built-in gate is not editable\");\n// Check caller has global gate-admin permission:\ncurl -u \"$TOKEN\": \"$SONAR/api/permissions/user?login=$USER\" | grep 'gateadmin'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Assign per-gate edit permissions to a dedicated group and keep users in that group.","Never attempt to modify built-in gates; copy them first.","Document which web services need global vs per-gate permission.","After SonarQube upgrades, re-verify per-gate permission grants."],"tags":["sonarqube","webapi","authorization","quality-gates"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}