🦅 The Organization Had No Owner… Yet I Could Still Join It

Let's Go

Target Overview

While testing the organization's invitation workflow, I discovered a business logic vulnerability affecting organization ownership.

The application allows users to:

• Create an organization.
• Invite other users.
• Accept invitations later.
• Delete their own account.

The expected behavior is simple: if the sole owner deletes their account, any pending invitations should become invalid to prevent users from joining an ownerless organization (or org itself deleted since it has no ower).

However, the backend doesn't enforce this rule.

Discovery

I wanted to know what would happen if the only owner deleted their account before an invited user accepted the invitation.

After deleting the owner account, I logged in as the invited user and accepted the pending invitation.

The invitation was still valid, allowing me to join an organization that no longer had an owner.

Proof of Concept

Scenario — Attacker Joins an Ownerless Organization and use its resources

1. Victim creates an organization.
2. Victim invites the Attacker.
3. The invitation remains pending.
4. Victim deletes their account (the only owner).
5. Later**, Attacker** logs in and accepts the invitation.

Result

The invitation is accepted successfully.

As a result:

• The organization becomes ownerless.
• The Victim permanently loses access after deleting their account.
• The Attacker keeps access to the organization and its resources.
• No administrator remains to manage or recover the organization.

Root Cause

The backend never verifies the organization's ownership state when an invitation is redeemed.

Pending invitations remain valid even after the sole owner has been deleted, allowing users to join organizations without any active administrator.

Report Status

Let's Connect: x account || linkedin|| facebook [new]

"سُبْحَانَكَ اللَّهُمَّ وَبِحَمْدِكَ ، أَشْهَدُ أَنْ لا إِلَهَ إِلا أَنْتَ ، أَسْتَغْفِرُكَ وَأَتُوبُ إِلَيْكَ"