1 first, we create two organizations: org1 and org2. The owner of them is user1 and user2 corresponding.

2 we login as user1 and update the org1, then we use burpsuit to get the post.

3 The first post will check user and we forward it.

4 The second post will edit content of organization and can be like: "id":1,"name":"org1","email":"org1@ict.ac.cn","description":"org1org1org1org1","externalId":null,"slug":null.

5 we replace content as "id":2,"name":"org2","email":"attack@ict.ac.cn","description":"attackattack","externalId":null,"slug":null.

6 check the email of org2 and we found its email is change as attack@ict.ac.cn.

Impact

An attacker change any organization