{"record":{"id":"ed0cd0a9e917f4c1","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-ed0cd0","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/TaskAction.java","lineNumber":146,"sourceCode":"    return dbClient.componentDao().selectByUuid(dbSession, projectUuid);\n  }\n\n  private void checkPermission(Optional<ComponentDto> component) {\n    if (component.isPresent()) {\n      checkComponentPermission(component.get());\n    } else {\n      userSession.checkIsSystemAdministrator();\n    }\n  }\n\n  private void checkComponentPermission(ComponentDto component) {\n    if (userSession.hasPermission(GlobalPermission.ADMINISTER) ||\n      userSession.hasPermission(GlobalPermission.SCAN) ||\n      userSession.hasComponentPermission(ProjectPermission.ADMIN, component) ||\n      userSession.hasComponentPermission(ProjectPermission.SCAN, component)) {\n      return;\n    }\n    throw insufficientPrivilegesException();\n  }\n\n  private static void maskErrorStacktrace(CeActivityDto ceActivityDto, Set<AdditionalField> additionalFields) {\n    if (!additionalFields.contains(AdditionalField.STACKTRACE)) {\n      ceActivityDto.setErrorStacktrace(null);\n    }\n  }\n\n  @CheckForNull\n  private String extractScannerContext(DbSession dbSession, CeActivityDto activityDto, Set<AdditionalField> additionalFields) {\n    if (additionalFields.contains(AdditionalField.SCANNER_CONTEXT)) {\n      return dbClient.ceScannerContextDao().selectScannerContext(dbSession, activityDto.getUuid())\n        .orElse(null);\n    }\n    return null;\n  }\n\n  private enum AdditionalField {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/TaskAction.java#L128-L164","documentation":"ForbiddenException 'Insufficient privileges' from /api/ce/task (and related task endpoints) when the user lacks any of: global Administer, global Execute Analysis (Scan), project Administer, or project Execute Analysis on the task's component, and additional task details are being requested. Only users with at least Scan-level access on the project may view its task details.","triggerScenarios":"GET /api/ce/task?id=...&additionalFields=... for a project the user/token has no role on; CI scripts querying another team's project tasks; tokens created for one project used against another.","commonSituations":"Monitoring scripts polling task status across many projects with a single low-privilege token; users removed from project groups; private projects in multi-team instances.","solutions":["Grant the token's user 'Execute Analysis' (or 'Administer') permission on the relevant project(s).","Use a user with global 'Execute Analysis' for cross-project monitoring scripts.","Restrict queries to tasks of projects the user can access; filter /api/ce/activity by authorized component keys.","Confirm the task's project key and re-check GET /api/projects/create permission listing for the user."],"exampleFix":"// before\nGET /api/ce/task?id=AX..&additionalFields=stacktrace -> 403\n// after: Administration > my_proj > Permissions -> grant 'Execute Analysis' to ci-bot\nGET /api/ce/task?id=AX..&additionalFields=stacktrace -> 200","handlingStrategy":"validation","validationCode":"// shell: check Scan-level access on the task's project first\ncurl -s -o /dev/null -w '%{http_code}' -u \"$TOKEN:\" \"$SONAR/api/projects/show?project=$KEY\" | grep -q 200 \\\n  || echo \"no Scan-level access to $KEY; /api/ce/task will 403\"","typeGuard":null,"tryCatchPattern":"try {\n  task = ws.get(\"/api/ce/task?id=\" + id);\n} catch (ForbiddenException e) {\n  log.warn(\"Requires Administer/Scan globally or on the project\");\n  throw e;\n}","preventionTips":["Use a monitoring token with global Execute Analysis for cross-project task polling.","Scope per-project scripts to projects the token can access.","Audit effective project permissions after team reorganizations."],"tags":["sonarqube","webapi","compute-engine","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}