CSRF in Organization Invitation Approval Flow Enables Unauthorized Onboarding of Pending Members

Vulnerability: Cross-Site Request Forgery (CSRF) (CWE-352) with invitation token exposure
Severity: Medium — Exploitation required an authenticated member account and owner interaction, but allowed unauthorized onboarding of arbitrary pending users into an organization by abusing the owner’s authenticated browser session (CSRF)

Summary

The application allowed organization members to invite other users via invitation links. After an invited user accepted the invitation, their account remained in a pending state until the organization owner approved the request through a verification link sent to the owner’s email.

While reviewing the invitation flow, I discovered an API endpoint that exposed invitation token values. Any organization member could access this token-listing endpoint. Direct approval of invitations remained restricted to the owner — non-owners received a 403 Forbidden response when attempting to use an approval token.