Accidentally granting admin access

Support

AI-generated summary

The discussion revolves around the possibility of accidentally granting admin access to a user on a Discourse forum. hello-smile6 initially raises the concern, and IAmGav responds that it’s easy to revoke admin permissions. However, hello-smile6 presents a hypothetical scenario where a malicious user grants admin permissions to everyone, revokes existing admin permissions, and suspends them. jomaxro emphasizes that if a non-trusted user gains admin access, the site should be considered compromised, and the site owner should follow the guidelines on what to do if your Discourse is compromised. He also notes that granting admin access requires email verification, making accidental grants unlikely, and that admin access on Discourse doesn’t grant server access. The discussion concludes with IAmGav offering help to recover a compromised forum and hello-smile6 clarifying that the scenario was hypothetical.

1

What if an admin accidentally makes a user admin or moderator? Could that happen?

2

it’s easy to revoke the admin/mod permission.

The grant button changes to revoke.

3

But what if a malicious user is expecting that, and grants everyone on a 2000+ -user Discourse forum admin permissions and revokes permissions on all existing admins, then suspends the existing admins so they cannot do anything?

4

We can’t protect admins from shooting themselves in the foot. If a non-trusted user gains admin access, for any reason, all bets are off. The site should be considered compromised. The site owner should follow What to do if your Discourse is compromised.

2 notes.

  1. Granting admin access isn’t as simple as just clicking a button. After clicking the “grant admin” button, one must receive a link via email to finalize the process. It is unlikely that an admin grants admin access accidentally.
  2. Even if a malicious actor has admin access on a Discourse forum, that access doesn’t grant server access. The site owner would still be able to take action via the console on the server.

This discussion seems to have gotten off topic though. Accidental or malicious admin access doesn’t have anything to do with the moderation guide. I’m going to move this to a new topic.

5

If you need help recovering your forum, then sent me a DM with the console details.

Note on this is, a developer access can’t be revoked.

6

That has not happened. It was hypothetical, but thank you.