From 6fc5d82f1d45bc71c1f0a5932ffe288116f2c34a Mon Sep 17 00:00:00 2001
From: FailSafe <190101117+failsafesecurity@users.noreply.github.com>
Date: Fri, 28 Aug 2026 07:05:40 +0300
Subject: [PATCH] fix: restrict email invite metadata lookup (#15150)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

This change restricts email invitation metadata lookup to the
authenticated user that the invitation was issued to.

## Impact

The public invite-info resolver returns workspace, owner, invitee, and
status details for a valid invitation identifier. For email invitations,
that information should only be returned to the intended recipient after
authentication.

## Fix

- Keep existing link-invitation behavior unchanged.
- For email invitations, require an authenticated user whose id matches
the invitation recipient before returning invitation details.
- Return the existing invalid-invitation error for mismatched or
unauthenticated access.

## Validation

- `git diff --check`
- Full test/lint suite was not run locally because dependencies are not
installed in this checkout.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Tightened invitation access checks so non-link invites are only
readable by the intended recipient.
* Invalid or missing user context now returns an error earlier,
preventing access to invite details when the invitation doesn’t match.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: failsafesecurity <190101117+failsafesecurity@users.noreply.github.com>
Co-authored-by: DarkSky <25152247+darkskygit@users.noreply.github.com>
---
 .../backend/server/src/core/workspaces/resolvers/member.ts   | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/backend/server/src/core/workspaces/resolvers/member.ts b/packages/backend/server/src/core/workspaces/resolvers/member.ts
index fa6a61e8d2..2addd5b8a9 100644
--- a/packages/backend/server/src/core/workspaces/resolvers/member.ts
+++ b/packages/backend/server/src/core/workspaces/resolvers/member.ts
@@ -566,6 +566,11 @@ export class WorkspaceMemberResolver {
   ): Promise<InvitationType> {
     const { workspaceId, inviteeUserId, isLink } =
       await this.workspaceService.getInviteInfo(inviteId);
+
+    if (!isLink && (!user || user.id !== inviteeUserId)) {
+      throw new InvalidInvitation();
+    }
+
     const workspace = await this.workspaceService.getWorkspaceInfo(workspaceId);
     const owner = await this.models.workspaceUser.getOwner(workspaceId);