It appears that temporary accounts can be given global user groups through the Special:GlobalUserRights page. We disabled the ability for temporary accounts to be assigned local user groups in subtasks of T330816. However, it appears that this was not also done for Special:GlobalUserRights.
Example on the beta wikis is https://en.wikipedia.beta.wmflabs.org/w/index.php?title=Special:Log&logid=457007
Steps to replicate the issue
- Have MediaWiki-extensions-CentralAuth installed
- Create a temporary account by making an edit to a page
- Log into a user with the steward group
- Go to Special:GlobalUserRights and enter the temporary account into the form
What happens:
You can assign global user groups to the temporary account
What should have happened instead:
You should not be able to assign user groups to the temporary account, in a similar way to Special:UserRights for local groups
