SA-2026-020: A refused invitation left a row that a later one could inherit

What it is

The invitation row, with its role, was stored before the check that refuses the editor role. The row was keyed by nonce, so a second invitation with the same nonce and an allowed role would enrol with the stored editor role. Expiry and handle were unchecked.

What an attacker could do

Role escalation to editor, once any role other than the editor may invite. Not exploitable today.

How: Invite with role editor (refused, row kept); invite again with the same nonce and role team.

Root cause

Side effects before validation.

What contributed

• The check order looked harmless because only the editor may invite.

What was not in place

Validate everything, then write.

The fix

Role, handle and an expiry within a month are checked first; a row must match the invitation that first used its nonce.

What prevents it now

Unit-tested: the escalation is refused.