Close the add-path route around the platform-admin lockout guard

Shipped

August 15, 2026 at 1:27 AM UTC

Author

Kamo

Commit

5d8549f

POST replaces an existing administrator's rights, so it can take them away as well as give them — but only the PUT and DELETE paths checked whether the edit would leave nobody able to manage the list. Re-adding the last MANAGE_PLATFORM_ADMINS holder with an empty set was a way around the rule the console shows you, and the recovery from it is a database session.