GHSA-v2q2-q246-8chm: 
JavaScript vulnerability analysis and mitigation

Summary

Any signed-in user can create an organization and add existing accounts to it by email. The response differs for unknown addresses and includes the member's phone and global roles, and an added membership can become the member's default organization in new access tokens.

Affected code

• src/routes/organization.routes.ts, src/controllers/organizations.ts (add member)
• src/services/organizationService.ts (member projection, default organization)

Fix plan

• 0.19.4: uniform response for unknown addresses, member projection without phone and roles for non-admin callers, default organization only from memberships the user created or an admin granted
• v0.20: invitation and acceptance flow (contract change; adapters, dashboard)