getsentry / getsentry/sentry

Incorrect Organization Membership Assignment on Invitation Acceptance

Open
#78,254 6 comments 0 reactions 0 assignees View on GitHub
Bug Metrics Product Area: Settings - Members
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
22h 21m
Merged PRs (30d)
586

Description

### Environment

SaaS ([https://sentry.io/]())

# Incorrect Organization Membership Assignment on Invitation Acceptance

**Issue:**
When a user is logged in with their account from organization X (with email X), and they receive an invitation to join organization Y via email Y, upon accepting the invitation, the system adds the user to organization Y with their email X instead of email Y.

---

## Steps to Reproduce:

1. Log in to your account using **organization X** with email **X**.
2. Receive an invitation to join **organization Y** at email **Y**.
3. Follow the invitation link to join **organization Y**.
4. The system initially displays the error message:
`There was an error loading the data`.
5. Refresh the page.
6. Observe that you have been added as a member of **organization Y**, but using your email **X** (from **organization X**), not the invited email **Y**.

---

## Expected Behavior:

* Upon accepting an invitation to **organization Y** using email **Y**, the system should either:
* Prompt the user to log out from the current account (if they are logged in with a different email), and then require them to log in with email **Y** to complete the invitation process.
* OR automatically associate the user with **organization Y** using **email Y**, even if they are currently logged in with a different email.

In either case, the system should prevent membership to **organization Y** being created under the incorrect email **X**.

## Actual Behavior:

* The user is added to **organization Y** using the logged-in email **X** (from **organization X**) instead of the invited email **Y**, leading to incorrect account associations.

---

## Severity:

* High: This bug results in incorrect organizational membership and potential access control issues.

We want to define a set of [lightweight metrics]() that SDKs can automatically collect for e.g. framework, language or platform, focusing only on signals that **do NOT overlap with Tracing**. Ideally these metrics should give a quick sense of app or runtime health, … while deeper investigation will still rely on traces or profiles.

Examples**:**

* Node.js runtime metrics (e.g., event loop delay, heap usage)
* Prisma-related metrics in Next.js
* Mobile CPU / memory usage to help surface potential ANRs or app hangs

---

**Candidate Metrics (add more below)**

* …

*(please also add ideas, questions or examples in comments)*

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.