1Password user invited unexpectedly
Description
AlphaSOC detected a 1Password user invitation. Invitations create a path for a new human user to join the account and access organization resources. Unexpected invitations may establish unapproved access to shared vaults and the sensitive items they contain.
Impact
An unauthorized invitation can establish a new attacker-controlled identity in the 1Password account. Depending on the permissions granted after acceptance, that identity may access shared vaults and the credentials, API keys, and other secrets they contain.
Severity
| Severity | Condition |
|---|---|
Medium | 1Password user invited unexpectedly |
Investigation and Remediation
Review the invitation event, including the inviting user, recipient address, source IP address, and intended group or vault access. Confirm that the invitation is part of approved onboarding. If it is unauthorized, cancel the invitation or disable the new account, remove any permissions granted to it, and investigate the inviting account for signs of compromise.