{"record":{"id":"f5c50202a0a866e8","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-f5c502","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"warning","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/PauseAction.java","lineNumber":57,"sourceCode":"    this.systemPasscode = systemPasscode;\n    this.ceQueue = ceQueue;\n  }\n\n  @Override\n  public void define(WebService.NewController controller) {\n    controller.createAction(\"pause\")\n      .setDescription(\"Requests pause of Compute Engine workers. Requires the system administration permission or \" +\n        \"system passcode (see \" + ProcessProperties.Property.WEB_SYSTEM_PASS_CODE.getKey() + \" in sonar.properties).\")\n      .setSince(\"7.2\")\n      .setInternal(true)\n      .setHandler(this)\n      .setPost(true);\n  }\n\n  @Override\n  public void handle(Request request, Response response) throws Exception {\n    if (!systemPasscode.isValid(request) && !userSession.isSystemAdministrator()) {\n      throw AbstractUserSession.insufficientPrivilegesException();\n    }\n\n    ceQueue.pauseWorkers();\n  }\n}\n","sourceCodeStart":39,"sourceCodeEnd":63,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/PauseAction.java#L39-L63","documentation":"POST api/ce/pause pauses all Compute Engine workers and is restricted to callers presenting a valid system passcode or authenticated as a system administrator. Otherwise AbstractUserSession.insufficientPrivilegesException() is thrown with 'Insufficient privileges'. This prevents non-admins from halting background analysis processing.","triggerScenarios":"Calling POST api/ce/pause without a valid system passcode and without system-administrator authentication.","commonSituations":"Maintenance automation run under a non-admin token; missing Authorization header; wrong sonar.systemPasscode configured on the client side; anonymous requests.","solutions":["Use a token from a user holding the Administer System global permission.","Provide the correct system passcode header matching sonar.systemPasscode server configuration.","Grant Administer System to the automation account if appropriate.","Check the server is the expected one and the token is still valid."],"exampleFix":"// before\ncurl -X POST http://sonar.example.org/api/ce/pause\n// after\ncurl -X POST -u myAdminToken: http://sonar.example.org/api/ce/pause","handlingStrategy":"validation","validationCode":"// check admin auth material exists before pausing workers\ndef assertCanPause(headers):\n    if 'Authorization' not in headers and 'X-Sonar-Passcode' not in headers:\n        raise ValueError('Need admin Authorization header or X-Sonar-Passcode')","typeGuard":null,"tryCatchPattern":"try:\n    requests.post(f'{SONAR_URL}/api/ce/pause', headers=auth)\nexcept requests.HTTPError as e:\n    if e.response is not None and e.response.status_code == 403:\n        raise PermissionError('api/ce/pause requires system administrator or valid passcode') from e\n    raise","preventionTips":["Provision an admin service account for CE maintenance operations.","Send the system passcode header if you rely on passcode auth.","Verify pause/resume needs with your SonarQube admin policy.","Log the authenticated user before the call to debug 403s quickly."],"tags":["sonarqube","webapi","authorization","compute-engine"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}