Two fixes that landed this week tighten who can do what in Home Assistant. Neither needs a configuration change, but both matter if more than one person has an account on your server.
Deleted accounts kept their open connections
Until now, deleting a user did not end that user's live sessions. The user store dropped the account's refresh tokens without running their revoke callbacks, and those callbacks are what close open WebSocket connections. A removed administrator could keep sending administrator commands for as long as an existing connection stayed up, for example an open browser tab or a running phone app.
Franck Nijhof's fix (Core pull request #186558), merged on 15 October 2026, revokes every refresh token of a user before the account is removed. Deactivating an account already worked this way, so the gap only affected deletion. Nijhof found the bug while building a new Debug console integration.
The fix is assigned to the Home Assistant Core 2026.10.2 milestone, which is due on 16 October; the project aims to ship patch releases on Fridays. Until then, a workaround follows from the pull request: deactivation already revoked tokens and closed connections, so deactivate an account first and delete it afterwards.
Non-admins could open admin-only apps
The second fix is in Supervisor, the component of Home Assistant OS and Supervised installs that manages apps (add-ons). Core lets ordinary users create ingress sessions, because the frontend needs them to open apps that are not restricted to administrators. The Supervisor ingress proxy, however, only checked that the session cookie was valid. Any logged-in user could open the ingress interface of any app, including those marked admin-only (panel_admin).
Stefan Agner's change (Supervisor pull request #7308) makes Supervisor resolve the user's role and answer with HTTP 403 when a non-admin session targets an admin-only app. Core has sent the user ID with each ingress session since version 2023.9, so the protection works as soon as Supervisor updates, whatever Core version you run. Sessions without user data are dropped, and sessions of removed or deactivated users are invalidated the next time they are used.
One limit remains. The role is cached per user and refreshed when that person opens a new session or Supervisor restarts, so demoting an administrator does not cut off every running session at once. Those sessions lose admin access at the next refresh or when they expire.
The change shipped in Supervisor 2026.10.2 on 14 October, and the release notes list it as a breaking change. On 15 October the stable channel still offered Supervisor 2026.09.3, while 2026.10.2 was available on the beta channel. Supervisor updates itself once a version reaches stable.
Home Assistant Container and Core installs have no Supervisor and no apps, so the second issue does not apply to them. The first one affects every installation type.