I am having an issue with my site, there are users accessing it and creating accounts without having a role.

users with no roles

Here we can see user roles is blank. From my understanding someone has found a weakness in our system and has exploited it to create accounts with no roles.

since the account has no role does this mean its not subjected to the rules of any role? Do these accounts have admin access to our site or would it be closer to anon users.

Is there any basic thing that I could do to stop people with no roles getting in? Or is there a way to see how a user with no role is created (understanding the process would help me fix the problem)?

Edit 1

Version: Drupal 7

Module: User 7.32

Module: LoginToboggan 7.x-1.4

  • Having no roles means having no exclusive access , for a better answer mention your drupal version , and some of third party modules installed in your site so maybe some one can recognize the weakness based on core or modules bug Aug 7, 2015 at 13:42
  • By default fresh users have no roles, only implicit "authenticated" role. If you didn't disable account creation, everything is as it is supposed to be. What's the problem?
    – Mołot
    Aug 7, 2015 at 13:43
  • The problem is that when i create a new account I have to have a role, these people or more likely bots are exploiting something to get inside without a role.
    – Joe Lloyd
    Aug 7, 2015 at 13:49
  • How long after the release of 7.32 did you actually update to it? It seems to me you may have been affected by drupalgeddon.. There have also been 3 security releases for drupal core since 7.32 which can be seen HERE
    – 2pha
    Aug 7, 2015 at 13:58
  • @2pha sorry I couldn't tell you when we updated I've only been on the project for 2 months and the login was built near 3 years ago to the best of my knowledge. Thanks for the link though.
    – Joe Lloyd
    Aug 7, 2015 at 14:05

1 Answer 1


Users with no roles are how the default "Authenticated user" role is listed. I.e. these have the access level that the system gives the role ""Authenticated user".

This by itself is nothing to be concerned about.

If you don't want to allow bots and fly-by users to create accounts, navigate to Home » Administration » Configuration » People » Account settings and under Registration and cancellation, click that only admins can create new accounts.

If you want people to able to create accounts, but not bots, you need to let the registration process tell bots and humans apart. One of these modules may help:

However, in 2015, bots like XRumer knows how to do most CAPTCHAs including math and "warped" letters - you may need to experiment a bit to find a CAPTCHA configuration that works.

But preventing spam registrations are actually the topic of this question: Unknown User Registered into my system

  • so these people are default users? On my system they need to pick a role to create an account, there should never be a situation where they can get in without a role. thanks for the info on "Authenticated user" roles btw
    – Joe Lloyd
    Aug 7, 2015 at 13:51
  • I do want people to be able to create accounts just not ones with no roles as they are clearly violating the create account process. I know bots will still try to create accounts but my assumption is they should come in as a "simple user" (an account with an unverified email)
    – Joe Lloyd
    Aug 7, 2015 at 13:55
  • you can use a captcha in your registration form so humans can create an account but not the bots Aug 7, 2015 at 13:58
  • Maybe I'm explaining this wrong sorry. So when someone is making an account there are 4 choices for 4 different types none of these choices would let a user make and account with the role "Authenticated user". what I mean to ask is how are bots able to make "Authenticated user" accounts when there is no basic path to make that type of user?
    – Joe Lloyd
    Aug 7, 2015 at 14:03
  • Bots do exactly the same thing as humans: They "click" on the link to create a user on your site's home page, and then fill out the form with a user name and an email address. If you require email verification, then the bot is programmed to go trough with that process as well. Some of the bots even know how to solve CAPTCHAs. Aug 7, 2015 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.