Admin CSV export trusts the orgId in the query string (demo)

Impact

An admin of one organisation can export the full member list, with emails and last-login IPs, of any other organisation by changing orgId in the URL.

AttackerAn admin of any organisation

Crossesthe organisation scope on admin routes

Getsother organisations' member exports

2 steps

Step 1: src/admin/export.ts:51Entry
requireAdmin checks the caller is an admin somewhere, not of which org.
50 router.get("/admin/export", requireAdmin, exportMembers);
Step 2: src/admin/export.ts:58Sink
orgId is taken from the query string and passed to the query.
57 const rows = await members.forOrg(req.query.orgId as string);

Use the organisation from the admin's session, or check membership of the requested org before exporting.