Summary
Databasement before 1.7.14 can retain an invitation authorization decision after validating a token on page load, without rechecking it when the invitation is accepted. An attacker with a leaked or forwarded invitation link may use this stale authorization state to overwrite an account password and gain authenticated access to managed database credentials and secrets.
Affected context
The vulnerability occurs in invitation workflows where:
- An invitation token is checked when the acceptance page is loaded
- The authorization result is cached or otherwise reused
- Token validity is not revalidated at the final acceptance action
- A token may be leaked, forwarded, or remain usable after the legitimate recipient accepts it
Databasement deployments using affected invitation handling may be exposed when acceptance state can persist across these workflow transitions.
Exploit preconditions
- Attack surface: Invitation acceptance workflow
- Required access: Possession of a leaked, forwarded, or otherwise disclosed invitation link
- Trigger point: Final invitation acceptance after the legitimate user has already completed acceptance
- Why exploitation is possible: The application relies on an earlier authorization decision instead of verifying the token's current validity at the state-changing action
Why this happens
The underlying flaw is an authorization state-validation failure. The application validates an invitation token during page rendering, then permits a later state-changing operation based on that earlier decision without confirming that the token is still valid, unused, and associated with the intended acceptance context.
This maps to CWE-863: Incorrect Authorization, because access to the password-setting and account-activation operation is granted using stale authorization state rather than a current authorization check.
Potential impact
- An attacker may overwrite an account password
- An attacker could gain authenticated access to the affected account
- Managed database credentials and application secrets may be exposed
- Account ownership and invitation integrity could be compromised
- An attacker may use the compromised account for further unauthorized activity
General mitigation guidance
Mitigation generally focuses on making authorization decisions at the exact state-changing operation and treating invitation tokens as single-use capabilities.
Common defensive patterns include:
- Revalidating token integrity, expiry, status, audience, and intended recipient during acceptance
- Atomically consuming invitation tokens so they cannot be accepted more than once
- Avoiding authorization decisions cached solely from page-load state
- Binding acceptance actions to the authenticated user and intended invitation context
- Requiring explicit identity verification for sensitive password or account changes
- Limiting account and secret access through least-privilege permissions
- Invalidating related sessions, tokens, and recovery paths after account ownership changes
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis and code review checks for authorization performed only during page rendering
- Review of invitation, password-reset, and account-claim workflows for missing checks at state-changing endpoints
- Tests that attempt token reuse, delayed acceptance, concurrent acceptance, and acceptance by a different user
- Monitoring for repeated invitation acceptance attempts and password changes following token use
- Policy enforcement requiring server-side, transactional validation for one-time capabilities
Automated application security testing can help detect discrepancies between page-load authorization and final-action authorization.
