From ad73ca300ce35e4d4d231a933de6f20f8203f3df Mon Sep 17 00:00:00 2001 From: Manish Gupta <59428681+mguptahub@users.noreply.github.com> Date: Sat, 20 Jun 2026 16:41:21 +0530 Subject: [PATCH] [WEB-7730] fix(security): scope cascade deletes to workspace in BulkDeleteIssuesEndpoint (#9270) * fix(security): scope cascade deletes to workspace in BulkDeleteIssuesEndpoint CycleIssue and ModuleIssue cascade deletes used raw issue_ids from the request instead of the already workspace+project scoped issues queryset, allowing cross-workspace deletion of related records. Fixes GHSA-6cw7-h92q-p9hg and GHSA-2rr4-rp7r-32p4. GHSA-7q7r-mrr4-2wwx (sub-issue parent reassign) covered in WEB-7727. Co-authored-by: Plane AI * chore: remove advisory ID reference from code comment --------- Co-authored-by: Plane AI Co-authored-by: sriramveeraghanta --- apps/api/plane/app/views/issue/base.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/api/plane/app/views/issue/base.py b/apps/api/plane/app/views/issue/base.py index d9e2ea5a5a..3868498d1d 100644 --- a/apps/api/plane/app/views/issue/base.py +++ b/apps/api/plane/app/views/issue/base.py @@ -771,10 +771,10 @@ class BulkDeleteIssuesEndpoint(BaseAPIView): total_issues = len(issues) # First, delete all related cycle issues - CycleIssue.objects.filter(issue_id__in=issue_ids).delete() + CycleIssue.objects.filter(issue__in=issues).delete() # Then, delete all related module issues - ModuleIssue.objects.filter(issue_id__in=issue_ids).delete() + ModuleIssue.objects.filter(issue__in=issues).delete() # Finally, delete the issues themselves issues.delete()