Executive Summary

CVE-2026-54320 is a high-severity vulnerability in Daytona versions 0.183.0 and earlier that allows an attacker to accept or decline organization invitations using an unverified email address.

Daytona authenticates users via OIDC and matches the invitation's target email against the email in the caller's token, but the invitation accept and decline endpoints did not require the email to be verified, unlike organization creation which enforced verification.

An attacker could register an email address matching a pending invitation without verifying it, then accept the invitation to join the target organization with the role specified in the invitation, including high-privilege roles such as Owner.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to an organization's resources by allowing an attacker to join the organization with the role assigned in the invitation, potentially up to Owner.

With such access, the attacker could manage sandbox configurations, membership, and other sensitive organizational settings, compromising confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying whether unverified email addresses have been used to accept or decline organization invitations in Daytona versions 0.183.0 and earlier.

Since the vulnerability exploits the acceptance of invitations without email verification, you can audit your organization's invitation logs or API access logs to check for invitation accept or decline actions performed by users whose emails are not verified.

There are no specific commands provided in the available resources to detect this vulnerability directly.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Daytona to version 0.184.0 or later, where the invitation accept and decline endpoints require verified emails.

As a temporary workaround before upgrading, ensure that your identity provider does not issue usable sessions for unverified email addresses, preventing attackers from accepting invitations without email verification.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to join an organization with an unverified email and gain access to sensitive organizational resources, including sandbox configuration and membership management.

Such unauthorized access and improper authentication could lead to violations of data protection and privacy regulations like GDPR and HIPAA, which require strict controls over user identity verification and access to sensitive data.

Therefore, exploitation of this vulnerability may compromise compliance with these standards by allowing unauthorized users to access and potentially manipulate protected information.

Useful 0 Not Useful 0