# No Email Checking at Invitation Confirmation Link leads to Account Takeover without User Interaction at CrowdSignal

CrowdSignal team invite confirmation link lacked email binding, letting an inviter click it to log into any existing user's account.

- Payout: hidden
- Severity: critical
- Program: Automattic
- Found by: bugra
- Disclosed: 2020-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/915110
- Library page: https://bugbountylibrary.com/r/h1%3A915110
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:critical technique:source-review vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** Team invitation confirmation endpoint (app.crowdsignal.com/users/list-users.php)
**Root cause:** The invitation confirmation link is not bound to the invited email address; clicking it authenticates the clicker as the invited account regardless of who they are.
**Steps:**
1. Log in to https://app.crowdsignal.com/users/list-users.php with a team account
2. Invite an email that already belongs to a victim user
3. Copy the generated confirmation link from the dashboard
4. Open the confirmation link while still logged in as the attacker
5. Observe session now belongs to the victim account
**How found:** Noticed the confirmation link is displayed in the inviter's dashboard and that inviting an already-registered email still yields a working link; hypothesized no email check occurs on confirmation.
**Exploitation:** Attacker with a team account invites a victim's existing email, retrieves the confirmation link shown in their own dashboard, and visits it to be logged in as the victim without any victim interaction.
**Insight:** When invite flows surface the confirmation link to the inviter, test whether the link validates the invited email against the session—if not, any existing account can be taken over by inviting its address.