Return to Answer

This is a privilege escalation attack, plain and simple. Using this, a non-moderator user can instruct the Community ♦ user to take disciplinary action against other users. In fact, they can answer ban other users under the right conditions – I've confirmed this (details not disclosed for obvious reasons). It's also difficult for moderators to detect when this is going on unless they're specifically looking for it – most moderators are aware of the issue, but this is still another thing for them to look out for.

Once this is fixed, we'd need a script to detect when people have been banned via this method, so moderators can review each case and correct them if necessary.

Updates:

• A viable, sophisticated proof of concept attack has been developed, involving this and some other (more deliberate) site features, to efficiently ban medium-sized groups of helpful, high-contributing users from day-old accounts. This is serious.

This is a privilege escalation attack, plain and simple. Using this, a non-moderator user can instruct the Community ♦ user to take disciplinary action against other users. In fact, they can answer ban other users under the right conditions – I've confirmed this (details not disclosed for obvious reasons). It's also difficult for moderators to detect when this is going on unless they're specifically looking for it – most moderators are aware of the issue, but this is still another thing for them to look out for.

Once this is fixed, we'd need a script to detect when people have been banned via this method, so moderators can review each case and correct them if necessary.

Updates:

• A viable, sophisticated proof of concept attack has been developed (moderator-only), involving this and some other (more deliberate) site features, to efficiently ban medium-sized groups of helpful, high-contributing users from day-old accounts. This is serious.

This is a privilege escalation attack, plain and simple. Using this, a non-moderator user can instruct the Community ♦ user to take disciplinary action against other users. In fact, they can answer ban other users under the right conditions – I've confirmed this. It's also difficult for moderators to detect when this is going on unless they're specifically looking for it – most moderators are aware of the issue, but this is still another thing for them to look out for.

Once this is fixed, we'd need a script to detect when people have been banned via this method, so moderators can review each case and correct them if necessary.

This is a privilege escalation attack, plain and simple. Using this, a non-moderator user can instruct the Community ♦ user to take disciplinary action against other users. In fact, they can answer ban other users under the right conditions – I've confirmed this (details not disclosed for obvious reasons). It's also difficult for moderators to detect when this is going on unless they're specifically looking for it – most moderators are aware of the issue, but this is still another thing for them to look out for.

Once this is fixed, we'd need a script to detect when people have been banned via this method, so moderators can review each case and correct them if necessary.

Updates:

• A viable, sophisticated proof of concept attack has been developed, involving this and some other (more deliberate) site features, to efficiently ban medium-sized groups of helpful, high-contributing users from day-old accounts. This is serious.

This is a privilege escalation attack, plain and simple. Using this, a non-moderator user can instruct the Community ♦ user to take disciplinary action against other users. In fact, they can probably answer ban other users under the right conditions. It's also difficult for moderators to detect when this is going on unless they're specifically looking for it – most moderators are aware of the issue, but this is still another thing for them to look out for.

Once this is fixed, we'd need a script to detect when people have been banned via this method, so moderators can review each case and correct them if necessary.

This is a privilege escalation attack, plain and simple. Using this, a non-moderator user can instruct the Community ♦ user to take disciplinary action against other users. In fact, they can answer ban other users under the right conditions – I've confirmed this. It's also difficult for moderators to detect when this is going on unless they're specifically looking for it – most moderators are aware of the issue, but this is still another thing for them to look out for.

Once this is fixed, we'd need a script to detect when people have been banned via this method, so moderators can review each case and correct them if necessary.