Daytona authenticates users via OIDC and matches invitation target emails against the caller's token email. However, before version 0.184.0, the invitation acceptance and decline processes did not require the email to be verified, unlike organization creation which enforced verification. On identity providers that allow self-service signup and issue sessions before email verification, an attacker could exploit this by registering an email matching a pending invitation, leaving it unverified, and accepting the invitation to gain unauthorized access with the invitation's assigned role. This vulnerability is addressed in daytona version 0.184.0.

An attacker can join a target organization by accepting an invitation without verifying the associated email address, potentially gaining elevated privileges up to the Owner role. This compromises the integrity of organization membership and access control, leading to high confidentiality and integrity impacts, and low availability impact as per the CVSS score.

Upgrade daytona to version 0.184.0 or later, where the vulnerability is fixed by enforcing email verification on invitation acceptance and decline paths. No other mitigation is indicated or required.