---
id: "GHSA-c85h-5mrr-mgx4"
page: "https://infrastack.ai/live/GHSA-c85h-5mrr-mgx4"
kind: "vulnerability"
aliases: ["GHSA-c85h-5mrr-mgx4"]
title: "better-auth: Organization admins can invite an owner with a padded role name"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "better-auth", "fixed": ["1.7.16"], "affected": ">= 1.5.5, < 1.7.16", "ecosystem": "npm"}, {"name": "better-auth", "fixed": ["1.8.0-beta.5"], "affected": ">= 1.8.0-beta.0, < 1.8.0-beta.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["better-auth", "cwe-180", "cwe-863", "node", "organizations", "package", "self-hosted"]
not_affected_if: ["no-organization-plugin", "only-creator-can-invite"]
published_at: "2026-11-03T21:39:49+00:00"
first_seen_at: "2026-11-09T22:53:20+00:00"
updated_at: "2026-11-09T22:57:01+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-c85h-5mrr-mgx4", "first_seen_at": "2026-11-09T22:53:20+00:00"}]
exploit_sources: []
---

# better-auth: Organization admins can invite an owner with a padded role name

Link for people: https://infrastack.ai/live/GHSA-c85h-5mrr-mgx4 (this .md is for agents)

The better-auth organization plugin checks invitation roles without trimming whitespace, so a role value like " owner" bypasses the rule that only owners can invite owners. An organization admin can use this to create a real owner account in their organization, then delete the original owners.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:better-auth affected >= 1.5.5, < 1.7.16 fixed 1.7.16
- npm:better-auth affected >= 1.8.0-beta.0, < 1.8.0-beta.5 fixed 1.8.0-beta.5

## How to check

- Check the installed version with `npm ls better-auth` and compare it to the fixed versions below.
- Check whether your app uses the organization plugin and whether any role other than the creator role (`owner` by default) can create invitations.
- Review existing invitations and memberships for role values that change when trimmed, such as `admin, owner`. Do not trim them in place.

## Fix

- better-auth `1.7.16` for the 1.7 line (affected from 1.5.5 up to 1.7.16).
- better-auth `1.8.0-beta.5` for the 1.8 beta line (affected from 1.8.0-beta.0 up to 1.8.0-beta.5).
- Workaround if you cannot upgrade: remove the invite permission from every role except the creator role, or reject invitation roles with leading or trailing whitespace before they reach Better Auth.

## Timeline

- 2026-11-09T22:53:20+00:00 ghsa-repo https://github.com/better-auth/better-auth/security/advisories/GHSA-c85h-5mrr-mgx4

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/better-auth/better-auth/security/advisories/GHSA-c85h-5mrr-mgx4

## From the sources

## Am I affected?

You are affected if you use the organization plugin from `better-auth` 1.5.5 or later, and a role other than the creator role can create invitations. With the default roles, organization admins can.

You are not affected if only the creator role (`owner` by default) can create invitations.

## Summary

The organization plugin stops members who are not owners from inviting someone as an owner. A role value with extra whitespace passed this check, so an admin could invite an account they control as an owner.

## Impact

An organization admin, or another non-creator role that can invite, can create a real owner account in the same organization. That owner can delete the organization and remove the original owners. The escalation stays inside an organization where the attacker can already invite members.

## Patches

Upgrade `better-auth` to 1.7.16, or to 1.8.0-beta.5 on the beta line.

Role lists are now trimmed and split on commas wherever they are stored or compared, and invitations with an empty role are rejected.

## Workarounds

Remove the invite permission from every role except the creator role, or reject invitation roles with leading or trailing whitespace before they reach Better Auth.

Audit existing invitations and memberships for role values that change when trimmed. Do not trim them in place: trimming `admin, owner` makes that member a real owner. Review owners invited by such members.

## Technical details

The creator role check compared the raw role string, while later checks split and trimmed it. A value such as `" owner"` passed the first check and became `owner` when the invitation was accepted.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_