# Accidentally granting admin access
**URL:** https://meta.discourse.org/t/accidentally-granting-admin-access/206410
**Category:** Support
**Created:** [October 9, 2021, 3:36am UTC](https://meta.discourse.org/t/accidentally-granting-admin-access/206410 "2021-10-09T03:36:18Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@hello-smile6](https://meta.discourse.org/u/hello-smile6)
#### Post date: [October 9, 2021, 3:36am UTC](https://meta.discourse.org/t/accidentally-granting-admin-access/206410/1 "2021-10-09T03:36:18Z")
What if an admin accidentally makes a user admin or moderator? Could that happen?
---
### Author:  [@IAmGav](https://meta.discourse.org/u/IAmGav)
#### Post date: [October 9, 2021, 7:31am UTC](https://meta.discourse.org/t/accidentally-granting-admin-access/206410/2 "2021-10-09T07:31:12Z")
it’s easy to revoke the admin/mod permission.
The grant button changes to revoke.
---
### Author:  [@hello-smile6](https://meta.discourse.org/u/hello-smile6)
#### Post date: [October 19, 2021, 12:34am UTC](https://meta.discourse.org/t/accidentally-granting-admin-access/206410/3 "2021-10-19T00:34:56Z")
But what if a malicious user is expecting that, and grants _everyone_ on a 2000+ -user Discourse forum admin permissions and revokes permissions on all existing admins, then suspends the existing admins so they cannot do anything?
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [October 19, 2021, 3:59am UTC](https://meta.discourse.org/t/accidentally-granting-admin-access/206410/4 "2021-10-19T03:59:43Z")
We can’t protect admins from shooting themselves in the foot. If a non-trusted user gains admin access, for any reason, all bets are off. The site should be considered compromised. The site owner should follow [What to do if your Discourse is compromised](https://meta.discourse.org/t/what-to-do-if-your-discourse-is-compromised/40129).
2 notes.
1. Granting admin access isn’t as simple as just clicking a button. After clicking the “grant admin” button, one must receive a link via email to finalize the process. It is unlikely that an admin grants admin access accidentally.
2. Even if a malicious actor has admin access on a Discourse forum, that access doesn’t grant server access. The site owner would still be able to take action via the console on the server.
* * *
This discussion seems to have gotten off topic though. Accidental or malicious admin access doesn’t have anything to do with the moderation guide. I’m going to move this to a new topic.
---
### Author:  [@IAmGav](https://meta.discourse.org/u/IAmGav)
#### Post date: [October 19, 2021, 7:03am UTC](https://meta.discourse.org/t/accidentally-granting-admin-access/206410/5 "2021-10-19T07:03:03Z")
If you need help recovering your forum, then sent me a DM with the console details.
Note on this is, a developer access can’t be revoked.
---
### Author:  [@hello-smile6](https://meta.discourse.org/u/hello-smile6)
#### Post date: [October 19, 2021, 10:37pm UTC](https://meta.discourse.org/t/accidentally-granting-admin-access/206410/6 "2021-10-19T22:37:00Z")
That has not happened. It was hypothetical, but thank you.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [December 6, 2021, 12:45am UTC](https://meta.discourse.org/t/accidentally-granting-admin-access/206410/7 "2021-12-06T00:45:10Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.