The vulnerability arises from improper authentication checks in the SAML functionality, specifically in the saml.ts file. An attacker with a valid token from one organization can manipulate the IDP settings and access sensitive metadata of another organization. This could lead to unauthorized access and potential account takeover if the email addresses of users are known.

An attacker with a valid token from Organization A can send a POST request to update the IDP of Organization B. Subsequently, the attacker can access the /v1/users/me/org endpoint to view the updated SAML metadata of Organization B, potentially leading to unauthorized access and account takeover.

Organizations using the affected software version with SAML functionality enabled are at risk. Specifically, any user with a valid token from one organization can exploit this vulnerability to access and manipulate the IDP settings of another organization.