FiveM Insider Threats: Rogue Admins, Offboarding and Auditing Who Can Touch What

FiveM Insider Threats: Rogue Admins, Offboarding and Auditing Who Can Touch What

Almost every FiveM security guide assumes the attacker is outside your city — an executor user, a scraper hunting your webhook, a booter pointed at your IP. Then a head admin you trusted for eight months has a bad month, and the call is coming from inside the house. FiveM admin abuse rarely arrives as a dramatic wipe. It starts with one spawned car for a mate and ends with an economy nobody can audit.

Your outward-facing defences do nothing here. Anticheat trusts your admins, and your firewall lets them in. All that stands between a resentful moderator and your player database is how carefully you handed out access three months ago.

What Counts as FiveM Admin Abuse?

FiveM admin abuse is any use of staff-granted access outside its intended purpose: spawning money, vehicles or items for friends, banning rivals or taking payment to ban, reading player data for personal reasons, quietly editing configs or payouts, and destructive acts like mass bans and database deletion. Most of it is quiet and profitable rather than loud and obvious.

The Blast Radius of Each Access Layer

Owners think in job titles — “he’s only a mod” — while the system thinks in capabilities. A moderator with live console access outguns a head admin without it.

Two rows sit outside the game and get overlooked for exactly that reason. Your store account holds payouts and customer emails, and it is the only proof of purchase for every asset you run — licences from a shop like cfxmods-tebex.io ride on a login co-owners often share. Your backup destination is worse: a full copy of the database behind a credential handed out casually and rotated never.

The layer everyone forgets

ACE grants and txAdmin admins are separate systems that never speak to each other. Deleting someone from the txAdmin admin list does not touch the add_principal line their licence identifier sits on in server.cfg or permissions.cfg. Plenty of ex-staff still hold in-game god mode months after their “removal”, because the owner watched one name vanish from one list and stopped looking.

Build an Access Inventory Before You Need One

You cannot audit what was never written down. Spend forty minutes on one table — a row per person, a column per layer above — and fill it from the systems, not from memory. Memory is how January’s ex-developer stays in authorized_keys.

1. txAdmin admins: the admin list page and txData/admins.json on disk. Record each admin’s actual permission set, not their tier name.
2. ACE grants: grep every cfg you load for add_principal and add_ace, including files pulled in by exec. Resolve each identifier to a human. Anything you cannot name comes out today.
3. Database users: SELECT user, host FROM mysql.user; then read the grants. One app user for the server, one admin user for you, nothing else.
4. Discord: every role carrying Administrator, Manage Server, Manage Roles or Manage Webhooks — and every bot holding the same.
5. Host access: authorized_keys on every user account, panel sub-users, and anyone ever sent the root password in a DM.
6. Commercial: who can log into your store, hosting billing, and the accounts holding your asset licences.

Two rules keep it useful. Every account is named — no shared “staff” login, ever, because two people behind one credential means your logs prove nothing and every dispute becomes a shouting match. And every row carries a date.

Detecting the Quiet Abuse

Loud abuse announces itself. The profitable kind hides in logs you have and never read. Detection is about ratios and reconciliation, not watching a log channel scroll past.

Money and items that came from nowhere

Do not start from admin-give logs. Anyone who knows those exist will use a route that skips them, or a dev command in a resource nobody audits. Start from the other end — total what exists, subtract what the server can explain:

-- what exists right now
SELECT SUM(money) FROM users;      -- ESX; QBCore keeps JSON in players.money

-- what the server admits creating this week
SELECT type, SUM(amount) FROM economy_log
WHERE created_at > NOW() - INTERVAL 7 DAY
GROUP BY type;

If circulation climbs eight percent while paychecks, job payouts and sales account for three, something is minting. That gap is the alarm. Identity comes next.

Correlating spawns with the people who benefit

The tell for friend-farming is proximity plus repetition. For every logged spawn or item give, record which non-staff players sat within roughly fifty metres at that moment, then aggregate over a month. Real moderation scatters across your player base; a shakedown clusters on the same four names. One admin whose spawns land near the same crew a dozen times is not having coincidences.

Bans as a side business

Ban-for-hire looks defensible one ban at a time, so measure per staff member:

• Overturn rate — bans later reversed on appeal. Anyone past roughly a quarter is careless or selling verdicts.
• Reason quality — blank, one-word or copy-pasted reasons. Genuine bans arrive with evidence attached.
• Target concentration — what share of one admin’s bans land on a single gang, faction or player-run business. Grudges spike here long before anyone files a report.

Add the boring signals: actions taken at 4am with six players online, and playermode sessions entered and never exited. Three hours of noclip is not moderation, it is shopping.

The Offboarding Checklist: Revoke First, Then Rotate

Staff leave constantly and most leave fine. Run the identical checklist for all of them anyway: a procedure you only run on people you are angry with is one that tips them off.

Revoke, in the first ten minutes

1. Remove the txAdmin admin entry, then check txData/admins.json to confirm it actually went.
2. Delete their add_principal lines from every cfg, then re-exec or restart. An edited cfg changes nothing until the server reads it again.
3. Strip staff roles in Discord, including anything granting Manage Webhooks.
4. Pull their public key from ~/.ssh/authorized_keys on every user account, and delete their panel sub-user.
5. Remove them from store, hosting and licence accounts, ending active sessions where the platform allows.
6. Drop any in-game whitelist or job grade carrying elevated commands. A police chief rank with a spawn menu counts.

Rotate, same day, no exceptions

These cannot be revoked: the person left with copies in their head, their notes or their clipboard.

1. MySQL passwords for every account they saw — plus a check that your DB user is bound to localhost rather than %.
2. Discord webhooks: delete and recreate. Regenerating a URL keeps the same channel, and stale URLs get pasted into replacement configs.
3. Convars and API keys in server.cfg: Tebex secret, map keys, anticheat licence, every third-party token.
4. txAdmin master credentials and the panel session secret.
5. Hosting and store passwords, with 2FA enabled if it somehow still is not.
6. Backup storage credentials. Skip this and an ex-admin still holds a nightly copy of the database you just secured.

The step almost everyone skips

Revoking access does not remove code somebody already planted. If a departing person held file or console access, diff your resources directory against a known-good copy, sort by modification time, list every resource missing from your installed-assets manifest, and read crontab -l for root and the game user as well. Escrow-protected assets from stores such as cfx-tebex.store narrow the search, since encrypted portions cannot be edited in place — but every open-source resource you run is fair game for a parting gift.

After an Incident: Scope Before You Restore

The instinct is to roll back to last night’s dump and get on with the evening. Resist it for an hour. If the abuse ran three weeks, last night’s dump contains three weeks of abuse and you spent your restore on nothing.

1. Contain. Cut access everywhere at once, not politely one platform at a time. Maintenance mode if money is still moving.
2. Scope. Find the earliest confirmed abusive action, then judge whether damage is concentrated on a few characters or systemic across prices and payouts.
3. Repair narrowly. Concentrated damage gets surgical fixes: strip the specific items and balances from the specific characters. A full restore punishes every innocent player for one person’s behaviour, and costs you more players than the abuse did.
4. Reinstall clean. Anything they could have touched gets a fresh download from the vendor holding the licence — official-tebex.io or wherever you bought it — never from files that sat on a box they had keys to.
5. Tell your players. A short honest post beats the version that leaks into a rival’s Discord. Communities forgive incidents; they do not forgive discovering you hid one.

Guardrails That Cost Nothing to Run

Permissions limit what one person can do alone. Culture limits what they will attempt.

Two-person rule on destructive actions. Wipes, mass bans, resource deletion, price or payout changes and schema edits need a second staff member signing off in writing. No approval tooling required — point a webhook at a channel every staff member can read, fire it on anything destructive, and abuse stops being quiet.

A break-glass account. One Master login nobody uses day to day, password in a manager, its use alerting the team. Everyday work happens on named accounts with narrower permissions, yours included. Owners who daily-drive Master are one stolen session from losing the city.

Quarterly access review. Twenty minutes with your inventory, four times a year. Anything unused for ninety days gets removed, and re-adding it takes thirty seconds. Most over-privileged staff are not villains — they are people who needed console access once, in March.

Temporary by default. New staff get moderation permissions and nothing else for sixty days; developers work against a test server, not production. When someone needs a dangerous permission for one job, grant it, note the date, and take it back when the job is done.

Most of your staff will never do worse than spawning themselves a nice car at 3am. But a server where abuse is visible, attributable and reversible is one where the tempted talk themselves out of it, and where the rest get caught in week one rather than month six. Writing down who can touch what takes an afternoon.