XF 2.2 Multiple users have had their primary user group changed to '0'

[Fullmental]

We're kind of confused by this one. It seems something is causing users primary user group values to change from our usual "registered" value to "0" (not a valid user group or group ID). This has happened twice now to one user and one staff member in the past week and a half, but we've made no configuration changes that we're aware of so we're not sure why this suddenly started happening. The only details we can find is in the user change log, it claims the user themselves changed that permission but they don't have the permission to update their own user group so that can't be accurate. The users themselves can't recall doing anything out of the ordinary to cause a change either.

I see no other logs at the same time in any of the other log views that might correspond to this change. We suspect it might be a cron entry but how do we figure out which one did this? We're on the latest 2.2 release of 2.2.16

 

[Fullmental]

I tried loading a backup to a dev site from the day the issue happened. I confirmed in the database that the user was assigned to the correct group, but as soon as I loaded the main forum page, it appears a cron job kicked off and changed the user's group ID. So I can't even get into the ACP to turn off cron jobs before they automatically run. Is there a way I can disable them from the terminal or config.php instead? I want to go in and run each job manually one by one until I find which one is causing a problem, but in order to do that they can't be running by themselves before I can get in the ACP.

 

[Paul B]

Log in to the ACP directly.

 

[Fullmental]

Log in to the ACP directly.

That does not help, unfortunately. The mere act of loading the ACP page triggers the user group to change. I don't even have to log in for it to happen, just loading the page is enough.

 

[Paul B]

You must have some custom code or crons running.

Can you list them and any add-ons.

 

[Fullmental]

You must have some custom code or crons running.

Can you list them and any add-ons.

Too many, I'm afraid. It's a highly customized site.

I was able to manually go into the xf_cron_entry table and update all rows to set active to '0'. That allowed me to load and log into the ACP. I was able to enable each cron job one by one until I found the offending job (which is a third party addon job, yes). We will reach out individually to the developer for further assistance. Thanks for the time and help!