AIKIDO-2026-461021

TL;DR

The SSO plugin's POST /sso/register endpoint lets any authenticated organization member attach a new SSO provider to that organization. The handler verifies only that the caller has a membership row and never checks whether they hold an owner or admin role, unlike the companion list, get, update, and delete endpoints that gate on isOrgAdmin. A low-privilege member can register an attacker-controlled OIDC or SAML identity provider on an organization they do not administer, and subsequent SSO callbacks can provision IdP-asserted users into that organization. The fix introduces a shared admin-role check so provider registration matches the protection on the other org-linked provider endpoints.