Incorrect Organization Membership Assignment on Invitation Acceptance
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 22h 21m
- Merged PRs (30d)
- 586
Description
### Environment
SaaS ([https://sentry.io/]())
# Incorrect Organization Membership Assignment on Invitation Acceptance
**Issue:**
When a user is logged in with their account from organization X (with email X), and they receive an invitation to join organization Y via email Y, upon accepting the invitation, the system adds the user to organization Y with their email X instead of email Y.
---
## Steps to Reproduce:
1. Log in to your account using **organization X** with email **X**.
2. Receive an invitation to join **organization Y** at email **Y**.
3. Follow the invitation link to join **organization Y**.
4. The system initially displays the error message:
`There was an error loading the data`.
5. Refresh the page.
6. Observe that you have been added as a member of **organization Y**, but using your email **X** (from **organization X**), not the invited email **Y**.
---
## Expected Behavior:
* Upon accepting an invitation to **organization Y** using email **Y**, the system should either:
* Prompt the user to log out from the current account (if they are logged in with a different email), and then require them to log in with email **Y** to complete the invitation process.
* OR automatically associate the user with **organization Y** using **email Y**, even if they are currently logged in with a different email.
In either case, the system should prevent membership to **organization Y** being created under the incorrect email **X**.
## Actual Behavior:
* The user is added to **organization Y** using the logged-in email **X** (from **organization X**) instead of the invited email **Y**, leading to incorrect account associations.
---
## Severity:
* High: This bug results in incorrect organizational membership and potential access control issues.
We want to define a set of [lightweight metrics]() that SDKs can automatically collect for e.g. framework, language or platform, focusing only on signals that **do NOT overlap with Tracing**. Ideally these metrics should give a quick sense of app or runtime health, … while deeper investigation will still rely on traces or profiles.
Examples**:**
* Node.js runtime metrics (e.g., event loop delay, heap usage)
* Prisma-related metrics in Next.js
* Mobile CPU / memory usage to help surface potential ANRs or app hangs
---
**Candidate Metrics (add more below)**
* …
*(please also add ideas, questions or examples in comments)*
Contributor guide
Assessment
This issue has not been assessed yet.