Troubleshooting that Pesky “INSUFFICIENT ACCESS ON CROSS REFERENCE ENTITY” Error

If any of you have ever dealt with the dreaded “INSUFFICIENT ACCESS ON CROSS REFERENCE ENTITY” error, you will probably agree that this is one of worst errors to debug in Salesforce. There is virtually no information with the error that helps identify the problem. Most of the time I find that there is a permission issue on a lookup field that is being populated in an insert or update.

Well, this case was very different. This time, I got the error from a batch job; here’s what I saw:

I turned on debug hoping I’d get a clue from there:

As you can see, that was pretty useless. Here is my code; see if you can spot the problem!

    
global BatchCommunityUserSharing(List<SObject>lstObj) {
  lstSObject = lstObj;
  system.debug('========> lstSObject = ' + JSON.serializePretty(lstSObject));
}

global Iterable start(Database.BatchableContext bc) {
  try
  {
    system.debug('========> start lstSObject = ' + JSON.serializePretty(lstSObject));
    return lstSObject;        
  }
  catch(Exception ex)
  {
    sendEmail('Exception occured in BatchCommunityUserSharing', 
                ex.getMessage() + 'n' + ex.getStackTraceString());
    return(new List());
  }
}

I had debug statements in the constructor and the start method of the batch class that I wasn’t seeing in the debug log. That meant that the error was happening BEFORE it got to my debug statements.

After digging for a while and getting frustrated, I decided to move on to my next task and get back to this later. I wrote my Apex class (using Mavens Mate), hit Save and saw this error:

The code that was causing the error looked like this:

select Id, Name, (Select Id from WorkOrders) from Account...

I copied the code into an “Execute Anonymous” window and executed it. Worked like a charm. I brought up developer console and executed the query. Again no error! Was it Mavens Mate that was doing something weird?

I logged into the server and updated the Apex Class on the server itself with my new code. Ugh! I got the same error while saving the class. So, it did not like my code in the Apex class but was executing the same query perfectly in developer console and execute anonymously. Stumped?

Finally, I decided to look at the Salesforce documentation on the WorkOrder object and saw that it was introduced starting with API version 36.0. I checked my Apex Class and found that it was set to API version 34.0. Voila! I changed the API version in my class and it saved successfully!

So, what has this got to do with my original problem? If you remember, the batch class was accepting a list of generic SObjects. The SObject that I was testing with was none other than WorkOrder, and the API version of by batch class was 34.0. I changed the API version of my batch class and it worked perfectly!

Conclusion

I know many of you have run into this error under various different circumstances.  I would love to hear from you about some of those. Since Salesforce provides so little information with that error, it would be great to have a database of probable causes. Need help with a specific error or development problem? We can help.