{"id":"GHSA-c85h-5mrr-mgx4","kind":"vulnerability","aliases":["GHSA-c85h-5mrr-mgx4"],"related":[],"title":"better-auth: Organization admins can invite an owner with a padded role name","description":"## Am I affected?\n\nYou are affected if you use the organization plugin from `better-auth` 1.5.5 or later, and a role other than the creator role can create invitations. With the default roles, organization admins can.\n\nYou are not affected if only the creator role (`owner` by default) can create invitations.\n\n## Summary\n\nThe organization plugin stops members who are not owners from inviting someone as an owner. A role value with extra whitespace passed this check, so an admin could invite an account they control as an owner.\n\n## Impact\n\nAn organization admin, or another non-creator role that can invite, can create a real owner account in the same organization. That owner can delete the organization and remove the original owners. The escalation stays inside an organization where the attacker can already invite members.\n\n## Patches\n\nUpgrade `better-auth` to 1.7.16, or to 1.8.0-beta.5 on the beta line.\n\nRole lists are now trimmed and split on commas wherever they are stored or compared, and invitations with an empty role are rejected.\n\n## Workarounds\n\nRemove the invite permission from every role except the creator role, or reject invitation roles with leading or trailing whitespace before they reach Better Auth.\n\nAudit existing invitations and memberships for role values that change when trimmed. Do not trim them in place: trimming `admin, owner` makes that member a real owner. Review owners invited by such members.\n\n## Technical details\n\nThe creator role check compared the raw role string, while later checks split and trimmed it. A value such as `\" owner\"` passed the first check and became `owner` when the invitation was accepted.","summary":"The better-auth organization plugin checks invitation roles without trimming whitespace, so a role value like \" owner\" bypasses the rule that only owners can invite owners. An organization admin can use this to create a real owner account in their organization, then delete the original owners.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"better-auth","fixed":["1.7.16"],"affected":">= 1.5.5, < 1.7.16","ecosystem":"npm"},{"name":"better-auth","fixed":["1.8.0-beta.5"],"affected":">= 1.8.0-beta.0, < 1.8.0-beta.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["better-auth","cwe-180","cwe-863","node","organizations","package","self-hosted"],"not_affected_if":["no-organization-plugin","only-creator-can-invite"],"how_to_check":"- Check the installed version with `npm ls better-auth` and compare it to the fixed versions below.\n- Check whether your app uses the organization plugin and whether any role other than the creator role (`owner` by default) can create invitations.\n- Review existing invitations and memberships for role values that change when trimmed, such as `admin, owner`. Do not trim them in place.","fix":"- better-auth `1.7.16` for the 1.7 line (affected from 1.5.5 up to 1.7.16).\n- better-auth `1.8.0-beta.5` for the 1.8 beta line (affected from 1.8.0-beta.0 up to 1.8.0-beta.5).\n- Workaround if you cannot upgrade: remove the invite permission from every role except the creator role, or reject invitation roles with leading or trailing whitespace before they reach Better Auth.","status":"open","published_at":"2026-11-03T21:39:49+00:00","first_seen_at":"2026-11-09T22:53:20+00:00","triaged_at":"2026-11-09T22:57:01+00:00","updated_at":"2026-11-09T22:57:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:57:01Z","model":"claude-haiku-5-5","output":{"fix":"- better-auth `1.7.16` for the 1.7 line (affected from 1.5.5 up to 1.7.16).\n- better-auth `1.8.0-beta.5` for the 1.8 beta line (affected from 1.8.0-beta.0 up to 1.8.0-beta.5).\n- Workaround if you cannot upgrade: remove the invite permission from every role except the creator role, or reject invitation roles with leading or trailing whitespace before they reach Better Auth.","reach":"internet","title":"better-auth: organization admins can invite an owner using a padded role","impact":"high","summary":"The better-auth organization plugin checks invitation roles without trimming whitespace, so a role value like \" owner\" bypasses the rule that only owners can invite owners. An organization admin can use this to create a real owner account in their organization, then delete the original owners.","audience":"developers","category":"package","nicknames":[],"who_cares":["better-auth","node","organizations","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"an org admin becomes a real owner, deletes the organization","analyst_note":"Empty when needs_analyst is false.","how_to_check":"- Check the installed version with `npm ls better-auth` and compare it to the fixed versions below.\n- Check whether your app uses the organization plugin and whether any role other than the creator role (`owner` by default) can create invitations.\n- Review existing invitations and memberships for role values that change when trimmed, such as `admin, owner`. Do not trim them in place.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-organization-plugin","only-creator-can-invite"],"who_is_affected":"You are exposed if your app uses the better-auth organization plugin from 1.5.5 or later and any role other than the creator role can create invitations; the default roles let organization admins do this. Apps that do not use the organization plugin, or where only the creator role can invite, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000865,"input_tokens":5078,"output_tokens":714,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-180':35B '-863':37B '1.5.5':107C '1.7.16':233C '1.8.0':236C '5mrr':18A,23A 'accept':358C 'account':82B,174C,198C 'admin':5A,73B,126C,170C,183C,310C 'affect':93C,96C,131C 'alreadi':224C 'anoth':185C 'attack':222C 'audit':291C 'auth':3A,27A,30A,33B,47B,106C,231C,290C 'becam':352C 'beta':240C 'beta.5':237C 'better':2A,26A,29A,32B,46B,105C,230C,289C 'better-auth':1A,25A,28A,31B,45B,104C,229C 'bypass':62B 'c85h':17A,22A 'chang':300C 'check':50B,167C,329C,337C,350C 'comma':250C 'compar':256C,330C 'control':176C 'could':171C 'creat':78B,119C,141C,194C 'creator':116C,135C,188C,275C,327C 'cwe':34B,36B 'default':123C,139C 'delet':87B,206C 'detail':325C 'empti':261C 'escal':215C 'everi':271C 'except':273C 'exist':292C 'extra':163C 'first':349C 'ghsa':16A,21A 'ghsa-c85h-5mrr-mgx4':15A,20A 'host':43B 'impact':180C 'insid':217C 'invit':7A,51B,69B,120C,142C,154C,172C,192C,225C,258C,268C,279C,293C,320C,356C 'later':109C,336C 'lead':282C 'like':60B 'line':241C 'list':243C 'make':312C 'member':148C,226C,314C,323C 'membership':295C 'mgx4':19A,24A 'name':14A 'node':38B 'non':187C 'non-creat':186C 'organ':4A,39B,48B,72B,85B,101C,125C,145C,182C,202C,208C,219C 'origin':89B,212C 'owner':9A,61B,67B,70B,81B,90B,137C,152C,158C,179C,197C,204C,213C,311C,317C,319C,346C,353C 'packag':40B 'pad':12A 'pass':165C,347C 'patch':227C 'permiss':269C 'place':308C 'plugin':49B,102C,146C 'raw':332C 'reach':288C 'real':80B,196C,316C 'reject':264C,278C 'remov':210C,266C 'review':318C 'role':13A,52B,58B,112C,117C,124C,136C,160C,189C,242C,262C,272C,276C,280C,297C,328C,333C 'rule':64B 'self':42B 'self-host':41B 'someon':155C 'split':248C,338C 'stay':216C 'stop':147C 'store':254C 'string':334C 'summari':143C 'technic':324C 'trail':284C 'trim':54B,246C,302C,305C,309C,340C 'upgrad':228C 'use':75B,99C 'valu':59B,161C,298C,343C 'wherev':251C 'whitespac':55B,164C,285C 'without':53B 'workaround':265C","nicknames":[],"mitigations":[],"who_affected":"You are exposed if your app uses the better-auth organization plugin from 1.5.5 or later and any role other than the creator role can create invitations; the default roles let organization admins do this. Apps that do not use the organization plugin, or where only the creator role can invite, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["betterauth"],"ptokens":["auth","better"],"labels":["betterauth","cwe180","cwe863","medium","node","npm","organizations","package","selfhosted"],"campaign_type":null,"search_a":"'5mrr':18A,23A 'admin':5A 'auth':3A,27A,30A 'better':2A,26A,29A 'better-auth':1A,25A,28A 'c85h':17A,22A 'ghsa':16A,21A 'ghsa-c85h-5mrr-mgx4':15A,20A 'invit':7A 'mgx4':19A,24A 'name':14A 'organ':4A 'owner':9A 'pad':12A 'role':13A","search_b":"'-180':35B '-863':37B 'account':82B 'admin':73B 'auth':33B,47B 'better':32B,46B 'better-auth':31B,45B 'bypass':62B 'check':50B 'creat':78B 'cwe':34B,36B 'delet':87B 'host':43B 'invit':51B,69B 'like':60B 'node':38B 'organ':39B,48B,72B,85B 'origin':89B 'owner':61B,67B,70B,81B,90B 'packag':40B 'plugin':49B 'real':80B 'role':52B,58B 'rule':64B 'self':42B 'self-host':41B 'trim':54B 'use':75B 'valu':59B 'whitespac':55B 'without':53B","search_c":"'1.5.5':107C '1.7.16':233C '1.8.0':236C 'accept':358C 'account':174C,198C 'admin':126C,170C,183C,310C 'affect':93C,96C,131C 'alreadi':224C 'anoth':185C 'attack':222C 'audit':291C 'auth':106C,231C,290C 'becam':352C 'beta':240C 'beta.5':237C 'better':105C,230C,289C 'better-auth':104C,229C 'chang':300C 'check':167C,329C,337C,350C 'comma':250C 'compar':256C,330C 'control':176C 'could':171C 'creat':119C,141C,194C 'creator':116C,135C,188C,275C,327C 'default':123C,139C 'delet':206C 'detail':325C 'empti':261C 'escal':215C 'everi':271C 'except':273C 'exist':292C 'extra':163C 'first':349C 'impact':180C 'insid':217C 'invit':120C,142C,154C,172C,192C,225C,258C,268C,279C,293C,320C,356C 'later':109C,336C 'lead':282C 'line':241C 'list':243C 'make':312C 'member':148C,226C,314C,323C 'membership':295C 'non':187C 'non-creat':186C 'organ':101C,125C,145C,182C,202C,208C,219C 'origin':212C 'owner':137C,152C,158C,179C,197C,204C,213C,311C,317C,319C,346C,353C 'pass':165C,347C 'patch':227C 'permiss':269C 'place':308C 'plugin':102C,146C 'raw':332C 'reach':288C 'real':196C,316C 'reject':264C,278C 'remov':210C,266C 'review':318C 'role':112C,117C,124C,136C,160C,189C,242C,262C,272C,276C,280C,297C,328C,333C 'someon':155C 'split':248C,338C 'stay':216C 'stop':147C 'store':254C 'string':334C 'summari':143C 'technic':324C 'trail':284C 'trim':246C,302C,305C,309C,340C 'upgrad':228C 'use':99C 'valu':161C,298C,343C 'wherev':251C 'whitespac':164C,285C 'workaround':265C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T21:39:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-c85h-5mrr-mgx4","url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-c85h-5mrr-mgx4","severity":"medium","published_at":"2026-11-03T21:39:49+00:00","modified_at":"2026-11-03T21:39:49+00:00","first_seen_at":"2026-11-09T22:53:20+00:00","fetched_at":"2026-11-09T22:53:20+00:00","note":null}],"documents":[{"id":110501,"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-c85h-5mrr-mgx4","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}