Body: <p>It seems like our site's security has been compromised. We have some annoymous_users creating pages and publishing articles. They are all showing as unpublished, but it seems like there's dozens of pages created. We are running CiviCRM on Drupal 8. If someone can advise on the corrective actions required here that would be great.</p>
  <p>Thanks</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-09-03T16:48:51.040Z
Comments.Text: This question maybe belongs on https://drupal.stackexchange.com instead but check the permissions under People - Permissions.
Comments.UserDisplayName: Demerit
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-09-03T20:28:18.700Z
Comments.Text: (EDIT - just saw you said this was Anonymous, so ignore the rest but will leave in case is ever relevant for others) The only connection I could think to civicrm was if you had something like CiviGroup Sync or CiviMember Sync set up that was giving a contact who signed up a Drupal role that had too many permissions. Or worse, if you have people creating a Drupal User via a Profile and your Drupal Permissions are letting 'Authenticated' create content which would be a risky set up. HTH
Comments.UserDisplayName: petednz - fuzion
Tags: <security><spam>
Title: Anonymours_User Creating Articles and Publishing Pages on Drupal 8
ThreadText: # Anonymours_User Creating Articles and Publishing Pages on Drupal 8
  
  (Asked by: username_0 on 2020-09-03)
  
  It seems like our site's security has been compromised. We have some annoymous\_users creating pages and publishing articles. They are all showing as unpublished, but it seems like there's dozens of pages created. We are running CiviCRM on Drupal 8. If someone can advise on the corrective actions required here that would be great.
  
  Thanks
  
  **Tags:** security, spam
  
  > **Comments:**
  > **username_1**: This question maybe belongs on https://drupal.stackexchange.com instead but check the permissions under People - Permissions.  
  > **username_2**: (EDIT - just saw you said this was Anonymous, so ignore the rest but will leave in case is ever relevant for others) The only connection I could think to civicrm was if you had something like CiviGroup Sync or CiviMember Sync set up that was giving a contact who signed up a Drupal role that had too many permissions. Or worse, if you have people creating a Drupal User via a Profile and your Drupal Permissions are letting 'Authenticated' create content which would be a risky set up. HTH  
  
  ---
  
  ## 0 answers
  
  