Description

In this case a attacker can be able to archive any user of any targeted organization

Proof of Concept

1. Attacker create new organization OrgA
2. Attacker add any user to his organization OrgA And archive the user
3. Capture this request in burp suite
4. victim is user of organization OrgB
5. Change id of our user to victim user of any organization then the user will be archived from OrgB4