🎯 New Report #3938927: An organization admin can create an attacker-controlled organization owner via the gem transfer flow
🔺Severity: High
👽 Reporter: timhaines
⭐️ Reputation: 424
🛠 State: resolved
💼 Team: RubyGems
💵 Bounty: null
🕐 Submitted: 2026-08-14
⏰ Disclosed: 2026-10-15 07:09:18
📝 Summary: An organization administrator was able to create an attacker-controlled organization owner through the gem transfer flow, bypassing the security policy that normally restricted owner role creation to existing owners. This privilege escalation allowed the attacker to remove legitimate organization members and publishers, and prevent them from publishing gems they previously had access to through their organization membership.
📂 Report JSON File: 3938927
@hackeronereports