🐛 Bug Report: Admin can delete their own account, resulting in a lockout if they are the only admin. #94

New Issue

OVERLORD · 2025-10-07T00:01:27+03:00

OVERLORD commented

2025-10-07 00:01:27 +03:00

Originally created by @zeedif on GitHub.

Originally assigned to: @kmendell on GitHub.

Reproduction steps

Set up a fresh instance of Pocket-ID with a single administrator account.
Log in as that administrator.
Navigate to the "Users" page in the admin settings (/settings/admin/users).
Find your own user account in the list.
Click the "Delete" button for your own account and confirm the deletion in the dialog.

Expected behavior

The application should prevent the deletion of the last (and only) administrator account. At a minimum, it should display a strong, explicit warning highlighting that this action will result in a complete lockout from the application, requiring manual database intervention to recover.

Actual Behavior

The application allows the deletion to proceed without any special warnings. The user is immediately logged out. Upon trying to log back in, no passkeys are found. The /setup endpoint correctly reports that setup is already complete, leaving the user completely locked out with no UI-based recovery path.

Version and Environment

Pocket ID Version: v1.6.4
Environment: Running via Docker Compose behind an Nginx Proxy Manager reverse proxy. The underlying database is the default SQLite.

Log Output

No response

Originally created by @zeedif on GitHub. Originally assigned to: @kmendell on GitHub. ### Reproduction steps 1. Set up a fresh instance of Pocket-ID with a single administrator account. 2. Log in as that administrator. 3. Navigate to the "Users" page in the admin settings (`/settings/admin/users`). 4. Find your own user account in the list. 5. Click the "Delete" button for your own account and confirm the deletion in the dialog. ### Expected behavior The application should prevent the deletion of the last (and only) administrator account. At a minimum, it should display a strong, explicit warning highlighting that this action will result in a complete lockout from the application, requiring manual database intervention to recover. ### Actual Behavior The application allows the deletion to proceed without any special warnings. The user is immediately logged out. Upon trying to log back in, no passkeys are found. The `/setup` endpoint correctly reports that setup is already complete, leaving the user completely locked out with no UI-based recovery path. ### Version and Environment * **Pocket ID Version:** v1.6.4 * **Environment:** Running via Docker Compose behind an Nginx Proxy Manager reverse proxy. The underlying database is the default SQLite. ### Log Output _No response_

OVERLORD closed this issue

2025-10-07 00:01:28 +03:00

OVERLORD commented

2025-10-07 00:01:30 +03:00

@kmendell commented on GitHub:

This should be fixed for the UI side of things here: f0c144c51c, An admin will now not be able to delete or disable their own account via the UI.

This will be available in the next release.

@kmendell commented on GitHub: This should be fixed for the UI side of things here: https://github.com/pocket-id/pocket-id/commit/f0c144c51c635bc348222a00d3bc88bc4e0711ef, An admin will now not be able to delete or disable their own account via the UI. This will be available in the next release.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#94