Security vulnerabilities

Description

I discovered a flaw in the organization user-invitation workflow that allows an owner to create a user and grant permissions without requiring the invited user to explicitly accept or verify the invitation
When an owner creates a user by entering an email address and assigning permissions, the account is immediately associated with the owner's organization. There is no verification of email ownership and no invitation-acceptance step before organization access is granted.
This becomes security-critical if an owner accidentally enters an attacker's email address while creating a privileged user. Once the attacker logs into the corresponding account, they are automatically granted access to the victim organization with the permissions assigned by the owner.

If administrative or other high-privilege permissions are assigned, this can provide the attacker with extensive control over the victim organization and its resources.

Steps to Reproduce

1. Log in to an Owner account.
2. Navigate to Permissions / User Management.
3. Click Add User.
4. Enter an email address controlled by another account/user.
5. Assign the user all available permissions, including privileged permissions.
6. Click Create User.
7. Observe that the user is added to the organization immediately.
8. Log in to the newly created user account.
9. Navigate to the organization.
10. Observe that the account already has access to the owner's organization with the permissions assigned during user creation.
11. No invitation acceptance or email-ownership verification is required.

Security Impact

An organization owner may unintentionally grant organization access to an attacker simply by entering the wrong email address.

For example:

Victim Owner → accidentally enters [attacker@example.com](mailto:attacker@example.com) → assigns Admin privileges → attacker logs in → immediate organization access

Depending on the assigned role, an attacker could potentially:

* Access sensitive organizational data
* View or modify organization resources
* Manage users and permissions
* Change organization settings
* Perform administrative actions
* Remove legitimate users
* Potentially delete or take full control of the organization

The vulnerability therefore creates a direct path from an accidental email-address mistake to unauthorized organization access.

Root Cause

The likely root cause is that organization membership and permissions are applied at user creation time rather than after successful invitation acceptance.

The system appears to treat the email address supplied by the owner as sufficient authorization to establish organization membership, without proving that the eventual account holder controls that email address.

Remediation

Implement an invitation-based membership workflow:

1. Create the user/invitation in a Pending state.
2. Send a unique, time-limited invitation link to the specified email address.
3. Do not grant organization access while the invitation is pending.
4. Require the recipient to authenticate and explicitly accept the invitation.
5. Verify ownership of the invited email address where applicable.
6. Activate the organization membership only after successful acceptance.
7. Allow owners to revoke pending invitations.
8. Consider notifying the owner when an invitation is accepted.

For privileged roles, additional confirmation or security controls should also be considered.

Summary
The organization invitation workflow does not enforce an explicit invitation-acceptance or email-ownership verification step before granting organization membership.