{"record":{"id":"f068bc6d7e7b712b","repo":"SonarSource/sonarqube","slug":"authentication-is-not-enforced-and-permissions-as","errorCode":null,"errorMessage":"Authentication is not enforced, and permissions assigned to the 'Anyone' group globally expose the instance to security risks. Unauthenticated visitors may unintentionally have permissions on projects.","messagePattern":"Authentication is not enforced, and permissions assigned to the 'Anyone' group globally expose the instance to security risks\\. Unauthenticated visitors may unintentionally have permissions on projects\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"server/sonar-webserver-core/src/main/java/org/sonar/server/platform/db/CheckAnyonePermissionsAtStartup.java","lineNumber":60,"sourceCode":"  public CheckAnyonePermissionsAtStartup(DbClient dbClient, Configuration config) {\n    this.dbClient = dbClient;\n    this.config = config;\n  }\n\n  @Override\n  public void start() {\n    Optional<Boolean> property = config.getBoolean(FORCE_AUTHENTICATION_PROPERTY_NAME);\n    if (property.isEmpty() || Boolean.TRUE.equals(property.get())) {\n      return;\n    }\n\n    logWarningsIfAnyonePermissionsExist();\n  }\n\n  private void logWarningsIfAnyonePermissionsExist() {\n    try (DbSession dbSession = dbClient.openSession(false)) {\n      if (!dbClient.groupPermissionDao().selectGlobalPermissionsOfGroup(dbSession, null).isEmpty()) {\n        LOG.warn(\"Authentication is not enforced, and permissions assigned to the 'Anyone' group globally expose the \" +\n          \"instance to security risks. Unauthenticated visitors may unintentionally have permissions on projects.\");\n      }\n\n      int total = dbClient.groupPermissionDao().countEntitiesWithAnyonePermissions(dbSession);\n      if (total > 0) {\n        LOG.atWarn()\n          .addArgument(total)\n          .addArgument(String.join(\", \", dbClient.groupPermissionDao().selectProjectKeysWithAnyonePermissions(dbSession, 3)))\n          .log(\"Authentication is not enforced, and project permissions assigned to the 'Anyone' group expose {} \"\n            + \"public project(s) to security risks, including: {}. Unauthenticated visitors have permissions on these project(s).\");\n      }\n    }\n  }\n\n  @Override\n  public void stop() {\n    // do nothing\n  }","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-core/src/main/java/org/sonar/server/platform/db/CheckAnyonePermissionsAtStartup.java#L42-L78","documentation":"CheckAnyonePermissionsAtStartup (invoked from start()) queries global permissions of the 'Anyone' group (null group id) at each startup. If the group holds any global permission, it logs this warning: with auth not enforced, anonymous visitors may effectively inherit those permissions on projects. It is an advisory security warning, not a failure.","triggerScenarios":"Server startup where groupPermissionDao().selectGlobalPermissionsOfGroup(dbSession, null) is non-empty — i.e. the 'Anyone' group has been granted global permissions such as Execute Analysis or Administer.","commonSituations":"Instances left in default/eval mode with anonymous access enabled; admins granting 'Anyone' broad permissions for convenience in CI (e.g. Execute Analysis) and forgetting them; legacy instances migrated from older permissive defaults.","solutions":["Remove the global permissions from the 'Anyone' group (Administration > Security > Global Permissions, or api/permissions/remove_group with groupId=null/anyone).","Enable authentication enforcement (sonar.forceAuthentication=true / Administration > Security) so anonymous users get no access.","Grant CI tokens only the specific permissions needed to named service accounts instead of 'Anyone'.","Review countEntitiesWithAnyonePermissions results for project-level 'Anyone' grants and clean those up too."],"exampleFix":"// before\ncurl -u admin:token -X POST 'api/permissions/remove_group?groupName=Anyone&permission=provision'\n// after — enforce auth and remove all Anyone permissions\nsonar.forceAuthentication=true\nfor p in admin provisioning execute_analysis; do curl -u admin:token -X POST \"api/permissions/remove_group?groupName=Anyone&permission=$p\"; done","handlingStrategy":"validation","validationCode":"// before startup, assert Anyone has no global permissions\nif (!dbClient.groupPermissionDao().selectGlobalPermissionsOfGroup(dbSession, null).isEmpty()) {\n  LOG.warn(\"Remove global permissions from 'Anyone' and enforce authentication\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enable sonar.forceAuthentication=true on all non-eval instances.","Audit 'Anyone' permissions (global and per-project) after upgrades.","Use named service accounts for CI instead of Anyone permissions.","Include this startup warning in security review checklists."],"tags":["security","permissions","anonymous-access","sonarqube"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}