DELETE /api/v2/organizations/{organizationId}/memberships/{membershipId} returns 200 but membership is not deleted (self-hosted v0.162.14)

[aeternuspolyphagus]

Product

Platform/Access controls/Other

Describe the bug

DELETE organization membership API returns 200 OK but does not remove membership

Description

The DELETE API endpoint for removing an organization membership returns HTTP 200 OK, but the membership is not actually removed.

After the successful DELETE request, the user is still present in the organization members list.

Environment

• Deployment: Self-hosted Docker Compose deployment
• Infisical image: infisical/infisical:latest
• Infisical version: v0.162.14

Docker image information:
INFISICAL_PLATFORM_VERSION=v0.162.14
NODE_VERSION=22.22.0

API endpoint

DELETE /api/v2/organizations/{organizationId}/memberships/{membershipId}

Response

The API returns:

HTTP/1.1 200 OK

Response body:

(empty)

PowerShell output:

StatusCode : 200
StatusDescription : OK
Content : {}
RawContent : HTTP/1.1 200 OK

To Reproduce

Request example

Invoke-WebRequest `
    -Uri "https://192.168.71.88/api/v2/organizations/{organizationId}/memberships/{membershipId}" `
    -SkipCertificateCheck `
    -Method Delete `
    -Headers @{
        "Authorization" = "Bearer <access_token>"
    }

### Expected behavior

Actual behavior

After the DELETE request completes successfully, the membership still exists.

The user is still returned by:

GET /api/v1/organizations/{organizationId}/members

with the same membership ID.

Expected behavior

The membership should be removed from the organization and should no longer appear in the organization members list.

### Screenshots

_No response_

### Deployment Type

Self-hosted

### Additional context

Additional information
The same API instance successfully handles other organization/project membership operations.
The request is sent through Traefik reverse proxy, but the backend logs confirm that the request reaches the application.
The issue appears to affect only the DELETE membership operation.

Could you please verify if this endpoint is working correctly in self-hosted deployments on version v0.162.14?

[linear]

ENG-5444

[antan2002]

I'd like to take this one. Looking at the code, the root cause is likely in the handler guard at backend/src/server/routes/v2/organization-router.ts:353 — if (req.auth.actor !== ActorType.USER) return; silently bails with empty 200 when using API_KEY or IDENTITY_ACCESS_TOKEN auth. Even if the reporter's JWT path is clean, the empty-200 response pattern is a bug regardless. The core delete logic in org-fns.ts:deleteOrgMembershipsFn and the ormify DAL layer look correct.

Proposed fix:

1. Replace the silent return with throw new BadRequestError(...) or a 403 so non-USER actors get a proper error
2. After deletion, assert the membership was actually removed (check deletedMembership isn't undefined) — currently const [deletedMembership] silently destructures undefined from an empty array
3. Same guard fix applies to bulkDeleteOrgMemberships endpoint on line ~432

Want me to send it as a PR?

[antan2002]

PR opened: #7480