Account pre-hijacking via implicit pending-invite acceptance

Authentication bypass in Teltonika Networks RMS before 5.7 allows remote authenticated users to pre-hijack accounts through pending invites. The invitation workflow binds an invited email address to the attacker's company when the victim registers directly, without requiring acceptance or awareness of the invitation. The attacker needs an RMS account and a pending invite for an unregistered victim; the victim must then register with that email, after which the attacker can manage the victim's account and company.