23

The user who is the subject of this CM escalation (link only visible to Stack Overflow moderators and Stack Exchange staff members) was suspended from reviewing for 365 days on Aug 10, 2022:
Table showing that a moderator suspended the user Aug 10 at 10:02 for 365 days

Later, the account that was suspended from review (linked just after "the Stack Overflow account:" in the aforementioned escalation) was merged into an older account.

It appears that, though the review suspension history carried over (including this suspension), the user is no longer suspended from review:
screenshot of mod dashboard showing "Review suspension: no (10 prior review suspensions)"

Could this be fixed to properly carry over the review suspension?

This is fairly easy to abuse, since in some cases accounts are merged automatically.

13
  • 1
    Which users can open that link? Only mods? Sep 16 at 7:16
  • 4
    @RandomPerson the link next to the words "mod-and-staff-only link"?
    – Ryan M
    Sep 16 at 7:16
  • 1
    Sorry, missed that. So a mod from any SE community can open that link? or only the relevant community mod? Sep 16 at 7:19
  • 4
    You don't have to be a "relevant" community mod; the link opens just fine for me.
    – Cody Gray
    Sep 16 at 7:21
  • 2
    @RandomPerson no. Moderator on the site where the link goes, in this case Stack Overflow. The only place where diamond "carries over" sites is the chat on stackexchange.com domain so I understand it can be confusing. Sep 16 at 7:28
  • 4
    It only works for SO mods and CMs. That said the link is useful for working out where the issue is for the folks looking at the issue, and that everyone else can't see it is irrelevant
    – Journeyman Geek Mod
    Sep 16 at 7:28
  • @JourneymanGeek Well, regarding the "irrelevant" part, I'm not sure. One cannot decide to vote on this post, when they can't see the whole picture. Sep 16 at 7:36
  • 20
    Everything you need to know about the motivation and validity of the bug report is in the post itself. It describes exactly what was expected, and what went wrong. It doesn't matter which specific user it was; that information is only going to be useful to the developer who has to debug this problem. Also, if you don't think there's enough information to vote on the bug report, then that's a fairly straightforward problem to solve: you don't vote on the bug report. @RandomPerson
    – Cody Gray
    Sep 16 at 7:40
  • I think this is definitely a security issue. A user with a review suspension can easily bypass it by triggering an automatic account merge or getting an employee who doesn't look to see the review suspension to merge their account. Sep 16 at 9:23
  • @Sonic my theory is that it wouldn't happen if the target account were the one with the suspension, and since merges always occur into the older account, it'd require the person trying to exploit this to have a spare older account than the one that they were suspended from reviewing on. Potentially exploitable but very impractical.
    – Ryan M
    Sep 16 at 9:31
  • I remember a prolific user who abandoned their old account and later on started contributing again under a new account. They later merged their newer account into their old inactive account once they remembered they had a prior existing (not deleted) account. I imagine quite a few users would "remember" they had a previous account and request a merge. It gets even easier if one uses the other exploitable issue with account merges to proactively evade post bans. Sep 16 at 9:37
  • 4
    I fail to see this as a security issue. Even if somebody deliberately exploits it to get away from a review ban, that's doesn't seem like a security problem.
    – VLAZ
    Sep 16 at 9:42
  • 2
    @Sonic security, in the wide meaning on SE, means as far as I can tell "something that affect other users and compromise their online identity or harms them in any other way". How exactly is exploiting the bug reported here is doing such a thing? (I was about to remove the security tag as well and put back moderator tools, but then realized the bug isn't in the mod tools either, so didn't do anything.) Sep 16 at 9:52

0

You must log in to answer this question.

Browse other questions tagged .