AIKIDO-2026-309251

TL;DR

The @workos-inc/authkit-nextjs package exposes a getOrganizationAction server action that resolves a client-supplied organization ID using the application's WorkOS API key. The action returns the full organization object without verifying that the caller is authenticated within that organization, so any caller can read arbitrary organizations by their ID. Under the default lazy middleware even unauthenticated requests can retrieve organization details such as metadata, external IDs, Stripe customer IDs, and domains. The fix scopes the lookup to the caller's own session and returns only the organization id and name.