Servers and applications
GHSA-wc74-2pg4-3fm2
Unverified profile email change hijacks pending organization invitations
- Severity
- Medium 6.0
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 0.31.1
- Weakness
- Mass assignment (CWE-915)
- Attack
- Over the network · Only under certain conditions · Needs a user account · No user action needed
- Attacker can
- Change data · Slow it down
- CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N- Sources
- Project advisories (GitHub)
Description
A signed-in user may edit profile data, but may not assert ownership or verification of an email address they do not control. Invitation acceptance relies on that email identity, so this crosses the account-verification boundary.
The authenticated user.update contract is derived from the database insert schema. It accepts both email and emailVerified, then spreads the request directly into the caller's user row.
An attacker can replace their email with the unregistered address of a pending invitation without proving control of that mailbox. An already verified account retains emailVerified=true. Alternatively the same request can assign that flag directly. user.getInvitations then discloses pending invitations for the claimed address, including their IDs and roles, and Better Auth permits the attacker to accept them.
The authenticated user.update contract is derived from the database insert schema. It accepts both email and emailVerified, then spreads the request directly into the…
Affected software
| Software | Affected versions |
|---|---|
DokployServers and applications · github:dokploy/dokploy |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-wc74-2pg4-3fm2
- github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-wc74-2pg4-3fm2