HackerOne · Report #48422
Team member invitations to sandboxed teams are not invalidated consistently (v2)
Summary
Due to an issue with accepting an invitation, a user would be added to the team without the invitation being invalidated, causing invitations to be reusable.
This would occur under certain circumstances in teams that are in sandbox mode.
How it was found
As per our email conversation on ticket 2527, I am giving you a proof of concept of my claim.
-
I have a sandboxed team in hackerone,named movielee.
-
The manager of that team (@haxorsistz) sends an invite to => ██████████
-
The link which I received on email was => https://hackerone.com/invitations/6fbca8af2f861c8174136f97ec51fde6
-
I logged in from another researcher (@geekboy) account and visited the link.Accepted the request.
-
Now I can see that invitation is still live.
So, a member of any team can pass this token to other people and they will be added to the team.I used this token 3 times and it's still live.