User accounts are mixed up and seem shared between users
-
Hello,
I've recently encountered something of the most weird kind : user accounts are mixed up. What I mean is that for example, a user A can login to their account, with their username and password, but will have access to an account B, including settings, emails, posts and more.
It is a profound security issue, and is also causing great confusion.
I've had to restore a backup of the database a few months back, and this issue did not appear at the time. Some accounts do no appear to be affected, as mine for example is normal.
Did anyone else have this issue ? Can I do anything to resolve it ?
I was thinking of deleting all the accounts and re-creating them and inviting the users to reset their passwords en masse, for example by exporting all the users to a CSV and then re-inviting them, but I am not sure it will resolve the issue.
It seems as if the user's ID have been linked to two accounts. A strange case of data schyzophrenia.
The forum is also extremely slow and shows a very high mongoDB usage.
Thank you for your help,
Cheers
I'm currently running NodeBB 3.9.0.
-
@nono-lqdn said in User accounts are mixed up and seem shared between users:
The forum is also extremely slow and shows a very high mongoDB usage.
Looks like you'll need to re-create your MongoDB indices.
db.objects.createIndex({ _key: 1, score: -1 }, { background: true }); db.objects.createIndex({ _key: 1, value: -1 }, { background: true, unique: true, sparse: true }); db.objects.createIndex({ expireAt: 1 }, { expireAfterSeconds: 0, background: true });As for the user accounts issue, that sounds concerning, but it sounds like we also need more information on how to reproduce that issue.
-
@julian said in User accounts are mixed up and seem shared between users:
As for the user accounts issue, that sounds concerning, but it sounds like we also need more information on how to reproduce that issue.
The only thing I can think of is that I've restored the mongod database of the forum.
