It looks like the only actions that are disabled by default are block, rangeblock, and degroup. The reason blockautopromote is available on enwiki is that no one's ever explicitly disabled it with $wgAbuseFilterActions['blockautopromote'] = false;, yes? The question is, do we need "community consenus" to get that line added, given that AFAIK no one has used that option in years on enwiki?

...sorry, didn't see that those were different. I guess this isn't a security issue then?
I would suggest that it be disabled by default, like (range)block and degroup.

To avoid breaking wikis that currently use this, the following query can be used: (this can also be done via api by anyone with global af helper rights):

SELECT afa_filter
FROM abuse_filter_action
WHERE afa_consequence = 'blockautopromote'

Those wikis can then by individually reenabled

In T245094#5879368, @suffusion_of_yellow wrote:

It looks like the only actions that are disabled by default are block, rangeblock, and degroup. The reason blockautopromote is available on enwiki is that no one's ever explicitly disabled it with $wgAbuseFilterActions['blockautopromote'] = false;, yes?

Exactly.

The question is, do we need "community consenus" to get that line added, given that AFAIK no one has used that option in years on enwiki?

I believe yes, but probably you don't need much participation.

In T245094#5879382, @DannyS712 wrote:

...sorry, didn't see that those were different. I guess this isn't a security issue then?

Indeed. I'm going to close this as invalid and make it public.

I would suggest that it be disabled by default, like (range)block and degroup.

Not convinced by this one, I don't think it causes any harm to leave it enabled. OTOH, we may have to re-enable it later for whatever wiki wants to opt-in.

In T245094#5880780, @Daimona wrote:

I'm going to close this as invalid and make it public.

Huh, apparently I can't. @Aklapper could you do that, please? Thanks!