Accept invitation flow consumes invite with the currently logged-in account instead of the invited email
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 21h 10m
- Merged PRs (30d)
- 635
Description
### Environment
SaaS (https://sentry.io/)
### Steps to Reproduce
1. Log into Sentry with Account A (email A) in the browser.
2. From a different account, send an organization invitation to email B.
3. Open email B's inbox (while still logged in as A in the same browser) and click the "Accept" / "Join" link in the invitation email.
4. Observe which account is added to the organization.
### Expected Result
The invitation should be bound to email B. Sentry should either:
- Accept the invite as email B, or
- Detect the mismatch between the logged-in account (A) and the invited email (B), and prompt the user to sign out and sign in as B before joining.
In no case should an invite sent to email B be silently consumed by a different account.
### Actual Result
The invitation was accepted by Account A. Email A was added to the organization that was only ever invited to email B. There was no warning, no confirmation step, and no indication that the logged-in account did not match the invited email.
This effectively lets the wrong identity end up inside the wrong organization without the user realizing it, which is a significant identity/access issue for an invitation flow.
### Product Area
Sign In
### Link
_No response_
### DSN
_No response_
### Version
_No response_
Contributor guide
Research direction
The report names no files, tests, or code entry points. Start by locating the invitation acceptance flow and its identity checks, then reproduce the mismatch between the logged-in account and invited email. Done means an invitation cannot be silently consumed by a different account and instead accepts the invited identity or prompts for the correct sign-in.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100