# Grant Admin without LoggingIn

**URL:** https://meta.discourse.org/t/grant-admin-without-loggingin/68894
**Category:** Feature
**Created:** [August 27, 2017, 11:32pm UTC](https://meta.discourse.org/t/grant-admin-without-loggingin/68894 "2017-08-27T23:32:24Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![barreeeiroo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/barreeeiroo/32/165264_2.png) [@barreeeiroo](https://meta.discourse.org/u/barreeeiroo)
#### Post date: [August 27, 2017, 11:32pm UTC](https://meta.discourse.org/t/grant-admin-without-loggingin/68894/1 "2017-08-27T23:32:24Z")

</div>

I’m not sure if this should be done without logging in, but I was able to grant admin without logging in with my account:

 ![Screenshot_20170828-012738](https://global.discourse-cdn.com/meta/original/3X/e/b/eb6550bc2ced2677a9180827547881fe57c241ff.png)  
What I’ve done was to Grant Admin to an user, logout, hit thr hab nk on the email and I verified the admin

I think that forbgranting administration it must be required to be signed in in all process, not just in the beggining, because anyone can accept that admin access 😕

---

<div class="post-metadata">

### Author: ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [August 28, 2017, 8:54am UTC](https://meta.discourse.org/t/grant-admin-without-loggingin/68894/2 "2017-08-28T08:54:01Z")

</div>

> [@barreeeiroo](#):
>
> because anyone can accept that admin access 😕

How? Accepting that requires the link in the mail.  
If an attacker can somehow get links in mails sent to you, he can also just reset your password and login.