Description There is a critical platform vulnerability that allows user records, including Agency Admin accounts, to be overwritten with data from unrelated contacts or sub-account users. This includes overwriting authentication fields such as phone numbers used for MFA and 2FA. This can occur during imports, cross-scope updates, API activity, or system processes. Audit logs show the update as if the admin performed it, even when they did not. This leads to lockouts, loss of access, inaccurate audit attribution, and no safeguards to prevent the overwrite. Problem Summary An Agency Admin authentication phone number was replaced by a sub-account user’s number. The system allowed this with no conflict checks, duplicate detection, or permission validation. Audit logs incorrectly attributed the change to the admin. The admin was locked out due to 2FA failure. This shows that lower-scoped user data can overwrite higher-privileged accounts. Current safeguards only protect contact records, not user records. Why This Must Be Addressed Authentication fields for Agency Admins should not be changeable by imports, automation API activity, or sub-account processes. Overwriting the login phone or the login email is a security risk. Audit logs cannot currently distinguish between manual actions and automated system updates. This vulnerability can lock out administrators, corrupt user identity data, and undermine confidence in platform security. Agencies with multiple sub-accounts and frequent imports are most at risk. Proposed Solution Protect authentication fields, such as login email and MFA phone, so they cannot be overwritten by imports, automations, or API calls across scopes. Require explicit re-authentication when authentication fields are changed. Prevent sub-account user data from updating the agency-level user records. Improve audit logs to clearly distinguish manual actions, import automation, and system-generated updates. Add conflict detection and duplicate warnings for user-level data, similar to contact protections. Provide a setting allowing admins to lock authentication fields from automated updates. Impact Without This Feature Agency Admins can be locked out due to unauthorized MFA changes. Data integrity is compromised when lower-scoped records overwrite high-privilege accounts. Support teams cannot accurately determine the cause due to vague audit logs. Agencies cannot safely use import workflows or API integrations without risk. Overall trust in the platform security model is weakened. Summary HighLevel needs stronger security controls to prevent cross-scoped overwrites of user data, especially authentication fields for Agency Admins, Agency Owners, and other privileged roles. Authentication data should be protected, audit logs must clearly identify the true update source, and imports or system processes must never overwrite admin identity fields.
