diff --git a/pkg/user/user.go b/pkg/user/user.go index 96863f398..2d46341f8 100644 --- a/pkg/user/user.go +++ b/pkg/user/user.go @@ -670,6 +670,11 @@ func GuardLastAdmin(s *xorm.Session, target *User) error { if !target.IsAdmin { return nil } + // target is not in the counted "reachable admin" set — removing them + // doesn't change the invariant, so the guard is a no-op. + if target.Status != StatusActive || !target.DeletionScheduledAt.IsZero() { + return nil + } session := s.Where("is_admin = ?", true). And("status = ?", StatusActive).