One of our customers is seeing this error when our app tries to insert campaign members:

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: []

The gist of the code:

1) Find leads & contacts that match the criteria

2) Add them with the same campaignId to a CampaignMember list

3) Try to insert the CM list, which then errors

An admin is the context user, sharing is public, though there is a lead assignment rule that changes the lead owner to another admin, though she doesn't have the Marketing user checkbox (shouldn't matter though).

Any ideas?

Code snippets:

                            List<Contact> contacts=[SELECT Id, FirstName, LastName, Email, AccountId FROM Contact WHERE Email IN: emailToRegistrant.keySet()];
                            if(contacts.size()>0){
                                Set<string> contactEmailsAlreadyProcessed=new Set<String>();
                                for (contact ct:contacts){
                                    //This handles the case where there are 2+ contacts with the same
                                    //email address.  Otherwise, emailToRegistrant will be blank for the 2nd
                                    //one as we remove the emails so they aren't processed for Leads
                                    if(contactEmailsAlreadyProcessed.contains(ct.email)==FALSE){
                                        contactEmailsAlreadyProcessed.add(ct.email);
                                        CampaignMember cmToInsert=new CampaignMember();
                                        cmToInsert.ContactId=ct.Id;
                                        cmToInsert.CampaignId=c.Id;
                                        cmToInsert.status=g2wUtils.setCMStatus(emailToRegistrant.get(ct.email).status);
                                        cmToInsert.g2wRegistrantKey__c=emailToRegistrant.get(ct.email).registrantKey;
                                        cmsToInsert.add(cmToInsert);                                
                                        emailToRegistrant.remove(ct.email);
                                    }//if 5
                                }//for 1
                            }//if 4
                            
                            List<Lead> leads=[SELECT Id, FirstName, LastName, Email, Company FROM Lead WHERE Email IN: emailToRegistrant.keySet()];
                            if(leads.size()>0){
                                Set<string> leadEmailsAlreadyProcessed=new Set<String>();
                                for (Lead l:leads){
                                    if(leadEmailsAlreadyProcessed.contains(l.email)==FALSE){
                                        leadEmailsAlreadyProcessed.add(l.email);
                                        CampaignMember cmToInsert=new CampaignMember();
                                        cmToInsert.LeadId=l.Id;
                                        cmToInsert.CampaignId=c.Id;
                                        cmToInsert.status=g2wUtils.setCMStatus(emailToRegistrant.get(l.email).status);
                                        cmToInsert.g2wRegistrantKey__c=emailToRegistrant.get(l.email).registrantKey;
                                        cmsToInsert.add(cmToInsert);                                
                                        emailToRegistrant.remove(l.email);
                                    }//if 5
                                }//for 1
                            }//if 4
Database.insert(cmsToInsert);

 The last line is where the error occurs.