getsentry / getsentry/sentry

Accept invitation flow consumes invite with the currently logged-in account instead of the invited email

Open
#116,118 3 comments 0 reactions 0 assignees View on GitHub
Bug Waiting for: Product Owner
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
21h 10m
Merged PRs (30d)
635

Description

### Environment

SaaS (https://sentry.io/)

### Steps to Reproduce

1. Log into Sentry with Account A (email A) in the browser.
2. From a different account, send an organization invitation to email B.
3. Open email B's inbox (while still logged in as A in the same browser) and click the "Accept" / "Join" link in the invitation email.
4. Observe which account is added to the organization.

### Expected Result

The invitation should be bound to email B. Sentry should either:
- Accept the invite as email B, or
- Detect the mismatch between the logged-in account (A) and the invited email (B), and prompt the user to sign out and sign in as B before joining.

In no case should an invite sent to email B be silently consumed by a different account.

### Actual Result

The invitation was accepted by Account A. Email A was added to the organization that was only ever invited to email B. There was no warning, no confirmation step, and no indication that the logged-in account did not match the invited email.

This effectively lets the wrong identity end up inside the wrong organization without the user realizing it, which is a significant identity/access issue for an invitation flow.

### Product Area

Sign In

### Link

_No response_

### DSN

_No response_

### Version

_No response_

Contributor guide

Open the contributing guide

Research direction

The report names no files, tests, or code entry points. Start by locating the invitation acceptance flow and its identity checks, then reproduce the mismatch between the logged-in account and invited email. Done means an invitation cannot be silently consumed by a different account and instead accepts the invited identity or prompts for the correct sign-in.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.