# Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite links

Replaying signup.createUser with a swapped team ID let an invitee join a different workspace than the one that invited them.

- Payout: hidden
- Severity: critical
- Program: Slack
- Found by: hunter0xp7
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1716016
- Library page: https://bugbountylibrary.com/r/h1%3A1716016
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:critical tech:rest technique:param-pollution vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** api/signup.createUser signup endpoint
**Root cause:** The signup endpoint trusted the client-supplied team ID parameter instead of binding it to the server-side invitation/OTP context, so the team ID could be swapped on replay.
**Steps:**
1. Obtain a workspace invitation and the resulting one-time password email.
2. Intercept the POST to `api/signup.createUser` with an intercepting proxy.
3. Replace the team ID parameter with an arbitrary target team ID.
4. Replay the request to complete signup into the target workspace.
**How found:** Researcher used an intercepting proxy to inspect and manipulate the signup request, noticing the team ID was client-controlled and replayable.
**Exploitation:** Attacker with a valid invite to any workspace replays the signup request with a substituted team ID, joining a workspace they were never invited to. Only works on workspaces that don't require admin approval for invitations.
**Insight:** On multi-tenant signup flows, check whether tenant/team identifiers in the request are bound to the server-side invite or OTP state; replaying with a swapped tenant ID tests for missing binding.