Unintended Exposure: How Slack Connect Quietly Defaulted to Open Signups ($1,750 Bounty)

Slack provides a convenience feature designed for seamless corporate onboarding: Approved Email Domains. When enabled, any user with an email address matching a verified corporate domain (e.g., @company.com) can autonomously join the workspace without an explicit invitation.

While analyzing the behavior of Slack Connect—a feature allowing separate organizations to collaborate within shared channels—I uncovered a dangerous configuration flaw. The platform was silently enforcing open domain signups on newly provisioned workspaces without user consent or notification.

The Silent Over-Privilege Flaw

The vulnerability triggered during a specific cross-organization collaboration workflow. When an administrator or user sets up a new, standalone workspace to accept an incoming Slack Connect channel invitation, the platform incorrectly inherited registration rules.

Instead of keeping the new workspace strictly private, Slack’s backend automatically enabled the "Allow people with approved email domains to join this workspace" toggle by default. The user accepting the invite remained completely unaware that their new, isolated sandbox was now visible and open to their entire corporate domain.

Steps to Reproduce

1. User A dispatches a Slack Connect channel invitation to User B.

2. User B accepts the invitation and chooses to provision a brand-new workspace to anchor the shared channel.

3. Once created, navigating directly to the signup path of the newly created workspace (https://<userBworkspace>.slack.com/signup) revealed that the open domain registration feature was live and active, binding itself to User B's email domain.

Deep Impact: The Insider Threat

While the requirement of sharing the same email domain initially implies a limited attack surface, the security implications for enterprise environments are severe.

• Predictable Enumeration: Slack provisions workspace subdomains sequentially rather than cryptographically (e.g., company-1, company-2), allowing an insider to easily scan and map out hidden workspaces.

• Vertical Privilege Escalation: If an executive or CEO creates an isolated, highly sensitive workspace to collaborate externally on confidential projects (like mergers or acquisitions), any low-privileged employee within the same corporate domain could discover and quietly join it.

• Bypassing Explicit Access Control: The flaw effectively turns a targeted, restricted communication channel into a public forum for anyone inside the organization's email perimeter.

Resolution

Initially, this behavior looked like a common customer misconfiguration, which would have led to an informational triage on specific company programs. However, deeper analysis proved it was a structural flaw in Slack's core invitation-handling logic.

I reported the logical vulnerability directly to Slack via their HackerOne program. The team acknowledged the systemic risk, patched the inheritance logic so that new workspaces default to strict privacy, and awarded a $1,750 bounty.

For more breakdowns of logical business flaws and platform security research, follow me on X: @siratsami71.