# Moderators should not be able to access customizations

**URL:** https://meta.discourse.org/t/moderators-should-not-be-able-to-access-customizations/55293
**Category:** Bug
**Created:** [January 6, 2017, 7:16pm UTC](https://meta.discourse.org/t/moderators-should-not-be-able-to-access-customizations/55293 "2017-01-06T19:16:32Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![barreeeiroo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/barreeeiroo/32/165264_2.png) [@barreeeiroo](https://meta.discourse.org/u/barreeeiroo)
#### Post date: [January 6, 2017, 7:16pm UTC](https://meta.discourse.org/t/moderators-should-not-be-able-to-access-customizations/55293/1 "2017-01-06T19:16:32Z")

</div>

Hi there 👋

I’ve discovered a security problem in Discourse related to moderators:  
There are some restricted zones for moderators in Admin Panel, and only admins can reach them, BUT if you have the full URL you can enter them:

 ![](https://global.discourse-cdn.com/meta/original/3X/f/d/fd8bfb853b170fde57b5cec9138cadecf020b884.png)

In this community I’m a moderator, but as you can see I can edit anything if I have the URL

Please, fix the issue

* * *

EDIT: It seems that the issue only affects to customize section, and only to some tabs

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [January 6, 2017, 7:44pm UTC](https://meta.discourse.org/t/moderators-should-not-be-able-to-access-customizations/55293/3 "2017-01-06T19:44:10Z")

</div>

Here’s a fix:

[https://github.com/discourse/discourse/commit/41307c3d1c75165445fe2f95b7b446507f4cf8e8](https://github.com/discourse/discourse/commit/41307c3d1c75165445fe2f95b7b446507f4cf8e8)

It’s been backported to all branches.

---

<div class="post-metadata">

### Author: ![barreeeiroo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/barreeeiroo/32/165264_2.png) [@barreeeiroo](https://meta.discourse.org/u/barreeeiroo)
#### Post date: [January 6, 2017, 7:45pm UTC](https://meta.discourse.org/t/moderators-should-not-be-able-to-access-customizations/55293/4 "2017-01-06T19:45:00Z")

</div>

Thanks for fixing it 👍

---

<div class="post-metadata">

### Author: ![tgxworld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tgxworld/32/106117_2.png) [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [January 9, 2017, 6:01am UTC](https://meta.discourse.org/t/moderators-should-not-be-able-to-access-customizations/55293/6 "2017-01-09T06:01:50Z")

</div>