Bypassing Slack’s Invite Acceptance via Role Modification ($1,500 Bounty)

Slack features robust team management controls, allowing workspace owners to invite users via email. Under normal conditions, an invited user remains in limbo as an "Invited Member" until they explicitly accept the invitation. If a user blocks invites from a specific workspace or individual, they shouldn't even receive the request.

While auditing Slack's user management logic, I discovered a critical business logic flaw that completely shattered this workflow, allowing an attacker to force any user into a workspace without their consent.

The Logic Flaw

When you invite a user via email, their initial status is Invited Member. While testing what an organization could do with a pending invite, I discovered I could proactively change the pending user's role.

1. I changed the pending user's role from Invited Member to Workspace Admin.

2. Next, I downgraded that same user from Workspace Admin back to a Full Member.

Instead of reverting the status back to Invited Member, Slack’s state machine broke. The account type permanently updated to Full Member.

By checking the victim's account, I confirmed they were instantly joined to the attacker's workspace. No email interaction, no "Accept" click, and no consent required.

Steps to Reproduce

1. As the attacker: Create a workspace (or use one where you have admin permissions) and invite the victim's email address.

2. As the victim: Do nothing. The invitation email can be completely ignored or even blocked.

3. As the attacker: Go to the user management dashboard. Change the victim's role to Workspace Admin.

4. As the attacker: Change their role again, this time down to Full Member.

5. The Result: The victim's status changes from "Invited" to active. When the victim logs into Slack, the attacker’s workspace is already listed in their active workspaces.

Impact & Resolution

This logical bypass allowed malicious actors to force targets into arbitrary workspaces. Once forced inside, the attacker could spam, call, or directly tag the victim, effectively rendering Slack's user-blocking and invitation-restriction features completely useless.

I reported this behavior to Slack's bug bounty program on HackerOne. The team triaged and patched the logic error, awarding a $1,500 bounty for the finding.

The report is publicly disclosed on my HackerOne profile: analyz3r. For more vulnerability write-ups, follow my updates on Twitter: @siratsami71.