a01b51fca5
The bulk update date endpoint fetched issues by ID without filtering by workspace or project, allowing any authenticated project member to modify start_date and target_date of issues in any workspace/project across the entire instance (IDOR - CWE-639). Scoped the query to include workspace__slug and project_id filters, consistent with other issue endpoints in the codebase. Ref: GHSA-4q54-h4x9-m329 |
||
|---|---|---|
| .. | ||
| middleware | ||
| permissions | ||
| serializers | ||
| urls | ||
| views | ||
| __init__.py | ||
| apps.py | ||