# Any user with invite capabilities can take-over any account on Discourse

Discourse's invite redemption endpoint logged in any user matching the supplied email without verifying the invite was bound to that email, letting any inviter take over any account.

- Payout: $1,024
- Severity: critical
- Program: Discourse
- Credited: mishre
- Disclosed: 2017-11-06
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/242765
- Library page: https://bugbountylibrary.com/r/h1%3A242765
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:critical tech:ruby technique:source-review vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** InvitesController invite redemption endpoint (/invites/redeem/:token)
**Root cause:** Invite.redeem_from_token used the attacker-supplied email parameter to look up and log in a user, without binding the invite token to a specific email or verifying ownership.
**Steps:**
1. Log in as a user with trust level >= 2 (invite capability).
2. POST /invites/link with `email=attacker@example.com` and CSRF token to obtain an invite token.
3. Open incognito and visit `/invites/redeem/{token}?email=victim@example.com`.
4. Observe session cookies set and being logged in as the victim account.
**How found:** Code review of InvitesController revealed redeem_from_token trusts params[:email] and calls log_on_user without verifying the invite was issued for that email.
**Exploitation:** Attacker with invite rights generates a disposable invite link, then appends the victim's email as the `email` query parameter on the redeem endpoint; the server logs the attacker's browser into the account matching that email, yielding full account takeover including admin accounts.
**Escalation:** Any inviter can target admin accounts by knowing only the admin's email or username, escalating to full site compromise.
**Insight:** Invite/redeem flows that accept an email parameter at redemption time are suspect: check whether the token is bound to the email at creation, and whether the login target is derived from user input rather than the token record.