binarybeach/bb-plane-fork
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: prevent privilege escalation in project member role updates (GHSA-494h-3rcq-5g3c) (#8833)

Browse source 
Restrict role modification in ProjectMemberViewSet.partial_update to
Admins only and enforce that requesters cannot modify or assign roles
equal to or higher than their own. Previously, Guests could demote
Admins by exploiting a missing lower-bound check on role changes.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
sriram veeraghanta 2026-04-06 15:54:01 +05:30 • committed by GitHub
parent a18d90da86
commit 587fe76032
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 29 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

43
apps/api/plane/app/views/project/member.py
View file

@ -226,21 +226,36 @@ class ProjectMemberViewSet(BaseViewSet):
is_active=True, is_active=True,
) )
if workspace_role in [5] and int(request.data.get("role", project_member.role)) in [15, 20]: if "role" in request.data:
return Response( # Only Admins can modify roles
{"error": "You cannot add a user with role higher than the workspace role"}, if requested_project_member.role < ROLE.ADMIN.value and not is_workspace_admin:
status=status.HTTP_400_BAD_REQUEST, return Response(
) {"error": "You do not have permission to update roles"},
status=status.HTTP_403_FORBIDDEN,
)
if ( # Cannot modify a member whose role is equal to or higher than your own
"role" in request.data if project_member.role >= requested_project_member.role and not is_workspace_admin:
and int(request.data.get("role", project_member.role)) > requested_project_member.role return Response(
and not is_workspace_admin {"error": "You cannot update the role of a member with a role equal to or higher than your own"},
): status=status.HTTP_403_FORBIDDEN,
return Response( )
{"error": "You cannot update a role that is higher than your own role"},
status=status.HTTP_400_BAD_REQUEST, new_role = int(request.data.get("role"))
)
# Cannot assign a role equal to or higher than your own
if new_role >= requested_project_member.role and not is_workspace_admin:
return Response(
{"error": "You cannot assign a role equal to or higher than your own"},
status=status.HTTP_403_FORBIDDEN,
)
# Cannot assign a role higher than the target's workspace role
if workspace_role in [5] and new_role in [15, 20]:
return Response(
{"error": "You cannot add a user with role higher than the workspace role"},
status=status.HTTP_400_BAD_REQUEST,
)
serializer = ProjectMemberSerializer(project_member, data=request.data, partial=True) serializer = ProjectMemberSerializer(project_member, data=request.data, partial=True)