a01b51fca5
The bulk update date endpoint fetched issues by ID without filtering by workspace or project, allowing any authenticated project member to modify start_date and target_date of issues in any workspace/project across the entire instance (IDOR - CWE-639). Scoped the query to include workspace__slug and project_id filters, consistent with other issue endpoints in the codebase. Ref: GHSA-4q54-h4x9-m329 |
||
|---|---|---|
| .. | ||
| admin | ||
| api | ||
| live | ||
| proxy | ||
| space | ||
| web | ||