Admin can delete itself

Issues
1

Issue Description

The admin account can delete all users including himself and then was locked outside the WebGUI.

Stalwart Version

v0.16.x

Installation Method

Docker

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Nothing stops an admin from deleting any account, its own included. To get back in, add STALWART_RECOVERY_ADMIN=admin:<password> to the container environment and restart. That login bypasses the directory, so you can sign in to the web UI with it and create a new administrator, then remove the variable and restart again; don’t leave it set. Steps are at Recovery mode | Stalwart.

The mailboxes of the users you deleted were queued for destruction along with the accounts, so recreating them gives you empty mailboxes. If that mail matters, it has to come from a backup.