# Moderadores podem mudar grupos de forma que percam acesso

**URL:** https://meta.discourse.org/t/moderators-can-change-groups-such-that-they-lose-access/391403
**Category:** Bug
**Tags:** groups
**Created:** [Dezembro 15, 2025, 11:05pm UTC](https://meta.discourse.org/t/moderators-can-change-groups-such-that-they-lose-access/391403 "2025-12-15T23:05:43Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Steradiant](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/steradiant/32/360541_2.png) [@Steradiant](https://meta.discourse.org/u/Steradiant)
#### Post date: [Dezembro 15, 2025, 11:05pm UTC](https://meta.discourse.org/t/moderators-can-change-groups-such-that-they-lose-access/391403/1 "2025-12-15T23:05:43Z")

</div>

Este bug é bem semelhante a

> [@Moderators can create/change categories such that they lose access](https://meta.discourse.org/t/moderators-can-create-change-categories-such-that-they-lose-access/390978):
>
> There is some setting which allows moderators to manage categories. If this is activated, moderators can change the security settings of a category such that they no longer have access, which is most likely accidental. Administrators can, of course, recover this situation. I suggest to remedy this behavior by forbidding moderators to change a categorry in such a way that they loose access.

Existe alguma configuração que permite aos moderadores gerenciar grupos.  
Se isso estiver ativado, os moderadores podem alterar as configurações de segurança de um grupo de tal forma que eles próprios percam o acesso, o que é possivelmente acidental.  
Os administradores podem, é claro, recuperar essa situação.

Além disso, há uma situação estranha adicional em relação ao acesso à lista de membros, onde os moderadores podem alternar se eles próprios veem a lista de membros.  
Mas talvez isso não seja um grande problema.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [Dezembro 19, 2025, 9:03pm UTC](https://meta.discourse.org/t/moderators-can-change-groups-such-that-they-lose-access/391403/3 "2025-12-19T21:03:35Z")

</div>

Um aviso (caixa de diálogo de confirmação) será exibido assim que este PR for mesclado

> <https://github.com/discourse/discourse/pull/36811>
>
> When moderators (with \`moderators\_manage\_groups\` enabled) change a group's visib…ility or members visibility to "Owners only" while not being an owner themselves, they would permanently lose access to manage that group. Similarly, removing themselves as owner when visibility is set to "Owners only" would lock them out.
> 
> This adds confirmation dialogs warning moderators before:
> \- Changing group visibility to "Owners only"
> \- Changing members visibility to "Owners only"
> \- Removing themselves as owner when visibility is restrictive
> \- Removing themselves as member when they're also an owner
> 
> Also refactors the category lockout code from PR #36663 to use async/await for consistency.
> 
> Ref: https://meta.discourse.org/t/391403

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [Dezembro 25, 2025, 7:00am UTC](https://meta.discourse.org/t/moderators-can-change-groups-such-that-they-lose-access/391403/4 "2025-12-25T07:00:02Z")

</div>

Este tópico foi fechado automaticamente após 17 horas. Novas respostas não são mais permitidas.
