Unauthorized Group Membership Removal via Group Member Invitation leads to Horizontal Privilege Escalation

Summary#

A business logic / broken access control issue allowed a Group Admin to indirectly remove users from groups they did not manage.

Steps#

1. Attacker has Group Admin privileges for Group A.
2. Victim is an active member of Group B.
3. Attacker adds/invites the victim to Group A.
4. The victim is automatically removed from Group B.
5. This allows the attacker to modify membership of another group outside their authorization scope.

Impact#

• Unauthorized removal of users from other groups.
• Bypass of intended RBAC boundaries.
• Potential disruption of critical teams by repeatedly transferring members.
• Allows a lower-privileged Group Admin to perform an action that should require higher organizational privileges.