The vulnerability arises from improper validation of project and user identifiers in the backend. This allows a user with team management permissions to invite users to projects in other organizations, change members to projects in other organizations, and escalate privileges. The attacker must first obtain valid user and project identifiers. The lack of validation leads to inconsistencies in the platform and unauthorized privilege escalation.

An attacker with team management permissions logs in and obtains the necessary authorization token. By manipulating the project identifier in the request, the attacker can invite users to projects in other organizations, change members to projects in other organizations, and escalate their privileges. This can cause significant inconsistencies and unauthorized access within the platform.

Users with team management permissions in version 1.2.4 who can manipulate project and user assignments. Organizations using this version are at risk of unauthorized access and privilege escalation.