Deleting users who have created content can lead to access bypass? The statement below appears in several places on the Internet about Drupal security. Is it the case that someone once wrote this and people repeat it in the their '10 Drupal security tips' posts without checking - or is there some truth to it?


  Disable user accounts and keep their contents. Deleting users who have
  created content can lead to access bypass.


Thanks.
Indeed the page at https://drupal.org/node/1732920 has an example scenario of how this can happen. I don't remember verifying that myself, but believe it came out of some research on an issue reported to the security team. I think Greg_1_anderson's comment about "edit own page content" is probably an important element to that scenario.

I've also seen this happen with node access modules. In discussing it with people, the theory that seems most likely:


User 42 exists and has been granted access to view and/or edit some nodes on a site using a node access module.
User 42 gets deleted, this invokes hooks including in the node access module which may take some action like updating the records it previously stored about user 42 to now point to uid 0 instead of 42
OR...perhaps it forgets update those records and instead they just exist with user 42 on them
When node access records are rebuilt, the code of this node access module either sets faulty records with uid 0 (based on step 2) or it fails to properly load a user and php/mysql will behave in their usual loosely typed ways and take the need for a record with a missing uid value and just insert a zero for the uid.


It's definitely a bug that has occurred more than once. If it can be prevented in code then it should be submitted to that module's issue queue to fix it.