Summary

Accepting an email invitation to an organization could be used to join a different team of that organization than the one the invitation was for.

Who was affected

Organizations without a synchronization that invite members by email, on Private Packagist Cloud until the fix on October 3, 2024, and on Private Packagist Self-Hosted installations running a version before 2.0.5 (KOTS) or 1.12.7 (Replicated Native). The invited person also needed to know the internal identifier of the other team.

Impact

A malicious user invited by email who knew the internal identifier of another team of the organization could have used the invitation to join that team instead of the team the invitation was for, and gained that team's access, for example to packages the inviting team had no access to. The invitation could not be used to join a different organization.

What we did

An invitation can now only be used to join the team it was sent for.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.5 (KOTS) or 1.12.7 (Replicated Native) or any later version. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required.
• Owners and admins who want to make sure their teams only contain the expected members can review team memberships and the audit log.

Credits

Thanks to Mohab Mohamed for reporting this issue.

All security advisories