Summary
A broken access control vulnerability in Liberu CRM allows a user with a pending team invitation to invite another account with an elevated administrator role. If the invitation workflow accepts attacker-controlled role data without validating the inviter's privileges, the second account may gain broad create, read, update, and delete access to team-scoped data.
Affected context
The issue affects Liberu CRM deployments using the team invitation workflow in versions where TeamPolicy::addTeamMember() treats a matching pending invitation email as sufficient authorization. Risk is present when invitation requests can specify privileged roles and InviteTeamMember does not independently verify whether the requesting user may grant those roles.
Exploit preconditions
- Attack surface: Team invitation functionality exposed through the application
- Required access: An account holding a pending invitation for the target team
- Trigger point: Processing a team-invitation request and subsequent invitation acceptance
- Required condition: The authorization predicate must accept the pending invitation match as adequate permission
- Why exploitation is possible: Role assignment is not consistently checked against the inviter's effective privileges, allowing an unauthorized user to cause an additional account to receive an elevated team role
Why this happens
The vulnerability results from an authorization decision based on an insufficient identity or relationship check. TeamPolicy::addTeamMember() effectively treats the existence of a pending invitation email match as proof that the requester may invite members, while the invitation workflow does not reliably enforce privilege-level constraints on the selected role. This maps to CWE-863: Incorrect Authorization, where access-control logic permits an operation without verifying that the subject has the required permission.
Potential impact
- An attacker-controlled account may receive administrator-level team access
- Unauthorized users could create, read, update, or delete team-scoped records
- Team membership and invitation controls could be altered
- Sensitive business data may be exposed or modified
- Data integrity, availability, and audit reliability could be affected
General mitigation guidance
Mitigation generally focuses on making authorization decisions from verified server-side permissions rather than invitation state alone.
Common defensive patterns include:
- Requiring an authenticated, authorized team administrator or equivalent role to issue invitations
- Enforcing server-side allowlists for assignable roles based on the inviter's effective privileges
- Treating role and team identifiers supplied by clients as untrusted input
- Applying the same authorization checks when creating, accepting, and finalizing invitations
- Using centralized policy checks consistently across controllers, policies, and service objects
- Recording invitation authorization decisions and applying least privilege to team roles
How teams detect issues like this
Organizations can look for:
- Static analysis patterns where request-supplied roles flow into membership creation without a policy check
- Code review signals involving email-matching logic used as a substitute for authorization
- Tests that attempt to assign roles above the requester's privilege level
- Audit events showing invitations issued by pending invitees or newly elevated accounts
- Policy enforcement requiring server-side authorization before team membership or role changes
Automated security review tools may help identify inconsistent authorization checks, but workflow-specific tests and audit analysis remain important.
