binarybeach/bb-plane-fork
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
bb-plane-fork/apps/api/plane/app/views
History
sriram veeraghanta 587fe76032
fix: prevent privilege escalation in project member role updates (GHSA-494h-3rcq-5g3c) (#8833) 
Restrict role modification in ProjectMemberViewSet.partial_update to
Admins only and enforce that requesters cannot modify or assign roles
equal to or higher than their own. Previously, Guests could demote
Admins by exploiting a missing lower-bound check on role changes.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 15:54:01 +05:30
..
analytic chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
asset fix: IDOR Vulnerabilities in Asset & Attachment Endpoints (#8644) 2026-02-20 18:03:57 +05:30
cycle chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
estimate chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
exporter chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
external chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
intake chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
issue fix: scope IssueBulkUpdateDateEndpoint query to workspace and project (#8834) 2026-03-31 17:43:35 +05:30
module chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
notification chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
page [WIKI-852] chore: update page version save logic (#8440) 2026-03-03 19:10:42 +05:30
project fix: prevent privilege escalation in project member role updates (GHSA-494h-3rcq-5g3c) (#8833) 2026-04-06 15:54:01 +05:30
search chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
state chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
timezone chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
user chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
view chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
webhook chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
workspace [VPAT-51] fix: update workspace invitation flow to use token for validation #8508 2026-02-17 00:02:18 +05:30
__init__.py chore: remove service token endpoint which is unused (#8797) 2026-03-25 13:13:58 +05:30
api.py chore: remove service token endpoint which is unused (#8797) 2026-03-25 13:13:58 +05:30
base.py chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30
error_404.py chore: add copyright (#8584) 2026-01-27 13:54:22 +05:30