Team invitation link returns "Forbidden" instead of acceptance page

[z411392]

Is this a hackmd.io issue?

• Yes, the bug happens on https://hackmd.io
• No. If it's a self-hosted CodiMD instance, please fire up the issue in the repo of CodiMD: https://github.com/hackmdio/codimd

What's the problem

Current behaviour

I received a team invitation email from HackMD. When I click the "Accept invitation" link in the email, the browser opens a page on https://hackmd.io that simply says "Forbidden". I cannot reach the screen where I would normally accept the invitation, so I am unable to join the team.

Steps to reproduce:

1. Receive a team invitation email from HackMD.
2. Click the "Accept invitation" link in that email.
3. The browser opens the invitation URL on hackmd.io.
4. A "Forbidden" page is shown instead of the invitation acceptance screen.

Screenshot:

Expected behaviour

After clicking the invitation link, I expect to land on the invitation acceptance page where I can review the team and join it, and then be redirected into the team workspace as a new member.

Environment

I use HackMD on:

Desktop

• OS: macOS
• Browser: Google Chrome
• Browser 148.0.7778.96

Additional context

• I am logged in to HackMD with the same email address that received the invitation: yes
• The invitation email was received on: 2026-05-13
• I have tried:
  • logout / login
  • with safari
  • clear cookies
  • Incognito window
    — same "Forbidden" page appears.