# למה אני עדיין צריך לאשר משתמשים שהזמנתי?

**URL:** https://meta.discourse.org/t/why-do-i-need-to-still-approve-users-that-i-have-invited/232196
**Category:** Support
**Tags:** invites
**Created:** [7 ביולי,‏ 2022,‏ 10:05am UTC](https://meta.discourse.org/t/why-do-i-need-to-still-approve-users-that-i-have-invited/232196 "2022-07-07T10:05:50Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![simonk](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simonk/32/247950_2.png) [@simonk](https://meta.discourse.org/u/simonk)
#### Post date: [7 ביולי,‏ 2022,‏ 11:15am UTC](https://meta.discourse.org/t/why-do-i-need-to-still-approve-users-that-i-have-invited/232196/2 "2022-07-07T11:15:15Z")

</div>

This was changed for security reasons:

> [@Staff-generated invites bypass the must\_approve\_users requirement](https://meta.discourse.org/t/staff-generated-invites-bypass-the-must-approve-users-requirement/228199):
>
> We’ve had a serious security issue with the invite system. I guess it’s easily reproducible. Our site is on invite-only. In addition, we have checked “must approve users” in the settings. One of our staff issued an invitation with a max use greater than 1, thus not restricted to one email in particular (example below). That invite link circulated, and people could register with it. Yet we expected that when “must approve users” is checked …

There’s currently no workaround:

> [@Allow users invited by staff to skip approval](https://meta.discourse.org/t/new-users-need-approval-despite-being-invited/231300/6):
>
> Yeah … long term solution I guess is to add a site setting that allows for the relaxed approval mode I guess, opt in. I worry though cause getting security right here is very very hard. The more edge cases we allow for, the more complexity and potential security flaws.

---

_[View the full topic](https://meta.discourse.org/t/why-do-i-need-to-still-approve-users-that-i-have-invited/232196)._