# Github Organization Takeover By Claiming Owner Invitation

Unverified email accounts could accept a pending GitHub org owner invitation, letting an attacker impersonate the invitee and take over the organization.

- Payout: $5,000
- Severity: high
- Program: GitHub
- Credited: Abss
- Disclosed: 2021-01-07
- Write-up quality: 7/10
- Original: https://abss.me/posts/github-org-takeover/
- Library page: https://bugbountylibrary.com/r/blog%3Aabss-me-posts-github-org-takeover
- Tags: domain:web impact:integrity impact:privesc kind:bounty platform:blog sev:high technique:source-review vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** Organization invitation acceptance endpoint (github.com/org_name)
**Root cause:** Invitation acceptance did not require the invitee's email to be verified, so any account registered with the invitee's email could claim the pending owner invitation.
**Steps:**
1. Create an org and invite a new owner via an email address that has no GitHub account.
2. Register a new GitHub account using that same invitee email, skipping email verification.
3. Visit `github.com/org_name`; the pending invitation (with invitation_token) is displayed.
4. Accept the invitation before the real invitee does; join the org as owner.
**How found:** While probing org invitation flows for privilege escalation, the researcher created an account with the invitee email and noticed the invitation still rendered and was acceptable despite no email verification, suspecting the check was client-side only.
**Exploitation:** Attacker registers an account with the invited owner's email without verifying it, then accepts the pending invitation shown on the org page, impersonating the invitee and gaining owner control of the organization.
**Insight:** When testing invite flows, register an account with the invitee's email before verifying it and check whether the pending invitation token is exposed and acceptable server-side without verification.