Other admin can “steal” connection ownership. Bug or by design?

  • Hi, on a site where multiple admins have a wordpress.com connection in Jetpack, we encountered the following issue:

    One admin, not the site connection owner, wanting to debug some account issue, disconnected from his Jetpack > My Jetpack admin page. In the background, this caused all other admin connections, including the one marked “owner” to be lost too. The admin, unaware of this fact, reconnected his account. This seemed to work fine but after landing on his My Jet page, he received an error about a token mismatch. Clicking the button “Reconnect Jetpack” seemed to fix the issue.

    After all this, the non-owner admin had become owner and all other connections were still lost. We had to reconnect each one and transfer ownership.

    Is it by design that a non-owner admin can unplug all other connections including the owner?

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Support lastsplash (a11n)

    (@lastsplash)

    Hi @ravanh

    Could you please post your site URL here so that we can have a look?

    If you want it to remain private, you can also contact us via this contact form:

    https://jetpack.com/contact-support/?rel=support&hpi=1

    If you choose to reach out directly, please include a link to this thread.

    Thanks!

    Thread Starter Rolf Allard van Hagen

    (@ravanh)

    Hi, yes the site this happened on is https://webzine.voyage

    Plugin Support Tamirat B. (a11n)

    (@tamirat22)

    Hello @ravanh,

    Thanks for getting back to us.

    I was able to replicate this issue on my test site when trying to disconnect a non-primary or non-owner user from Jetpack → My Jetpack → Connection. The issue doesn’t appear to exist if you disconnect the specific non-owner user from Jetpack → Dashboard → Connections → Account connection. That’s because the latter approach distinctly differentiates between the site’s Jetpack connection and your account’s specific connection.

    I have reached out to our development team to see if there is anything that can be done address this confusion and also if two different admin users should have access to each other’s Jetpack connection in such a manner.

    I will get back to you as soon as I have updates on this.

    Best,

    Plugin Support Alin (a11n)

    (@alinclamba)

    Hi @ravanh,

    To clarify, in WordPress, all administrators have equal permissions and access rights. This means any admin can perform actions such as disconnecting Jetpack from WordPress.com. There isn’t a concept of a “primary” or “owner” admin within WordPress itself, so Jetpack respects this level of access and cannot restrict one admin from disconnecting the site connection entirely, even if they are not the initial connecting user.

    However, I understand how this can be confusing, especially if it’s not immediately clear whether a particular action affects only the individual admin’s account connection or the entire site. We do provide prompts to notify users about the impact of disconnecting the site and offer the option to disconnect only their account, as shown in the screenshot.

    We are also exploring ways to improve the clarity of these prompts to prevent any accidental disconnections and ensure admins understand the scope of their actions.

    Thank you for helping us identify this area for improvement. If you have further questions or would like additional assistance, please feel free to reach out.

    Best regards!

    Thread Starter Rolf Allard van Hagen

    (@ravanh)

    Hi @alinclamba thanks for your explinations. So I understand it is by design…

    However, I understand how this can be confusing, especially if it’s not immediately clear whether a particular action affects only the individual admin’s account connection or the entire site.

    I suggest starting with different wording/titles in the WordPress admin. Instead of “My Jetpack” maybe a more neutral “Dashboard”. And “Manage site Jetpack connection” instead of “Manage your Jetpack connection” as header of the Manage popup… ??

    Plugin Support Alin (a11n)

    (@alinclamba)

    Hi @ravanh,

    Thank you for your feedback and suggestions. I shared them with our team for internal discussions.

    That said, I’m going to mark the thread as resolved, so if something else comes up, feel free to reach out again.

    Best!

Viewing 6 replies - 1 through 6 (of 6 total)
  • You must be logged in to reply to this topic.