Race Condition Allows Bypassing free Plan Member Limit

Summary#

A race condition in a SaaS application's member invitation functionality allowed a user to bypass the 2-member limit imposed on the lowest subscription tier.

Steps#

1. Use an organization subject to a strict member limit.
2. Capture the member invitation request.
3. Send multiple invitation requests concurrently using unique email addresses.
4. Due to the race condition, multiple requests are processed before the member-limit check is updated.
5. Approximately 50 pending invitations were successfully created, and the invited users could complete registration.

Impact#

• Bypass the plan's member restriction.
• Create numerous valid invitations.
• Allow additional users to join without upgrading.
• Circumvent subscription, billing, and licensing restrictions.