Thank you for the transparency and swift solution!

Any truth to what I've heard this may have been done by a group we defederated with?

Well done all involved. Sounds like it was caught and mitigated quickly

Thanks for fixing and being so open about it

Good job. I don't understand very much of that, so that makes me all the more grateful. Thank you.

I just disabled whole "/admin" section on my instance and added nice message 😆

The quick fix is much appreciated, thank you and everyone that helped for your hard work!

On Liftoff, I had to clear cache and storage in order to log back in. Still having issues with the website on Chrome, which keeps telling me I'm not logged in after clearing cache and logging back in.

At least now we can mark off the "disruptive website defacement attack" line on the checklist of (relatively) new website growing pains. Better to have them make lots of noise and get fixed quickly than quietly do sneaky things in the background.

Thanks for your efforts. I know that Lemmy was put in place rather quickly as a Reddit alternative. But I'm genuinely hopeful that this will be a good alternative.

Does an admin account have any permissions to view email addresses or data of registered users?

Did MichelleG not have 2FA enabled?

Now that this has happened, it's be worth pushing this issue through as high priority. If HttpOnly was enabled, then an admin takeover would not have been possible.

https://github.com/LemmyNet/lemmy-ui/issues/1252

That doesn't surprise me. Especially the "homemade" instances. The documentation is severely lacking and I had to fix lots of stuff in the instructions with try&despair to make my instance run.

There's not a great focus in security if your application starts with "step 1: install docker"