Manish Gupta 2844c1d695 [WEB-8074] fix: scope IssueListEndpoint to guest created_by ...

IssueListEndpoint.get (/workspaces/<slug>/projects/<project_id>/issues/list/)
returned any issue whose id was passed in ?issues=, without the guest
created_by restriction its sibling IssueViewSet.list enforces. A project GUEST
(role=5) on a project with guest_view_all_features=False could read issues they
did not author by supplying their ids (GHSA-32c7-84jc-4w67).

Replicate the guest scope: when the requester is an active role=5 ProjectMember
and not project.guest_view_all_features, filter the queryset to
created_by=request.user. Applied to the base queryset so it flows through
filtering, annotation and grouping.

Contract regression tests cover the restricted guest (own-only), a full member
(sees all), and a guest with guest_view_all_features enabled (sees all);
fail-before verified.

Co-authored-by: Plane AI <noreply@plane.so>

2026-07-08 16:31:58 +05:30

..

admin

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30

api

[WEB-8074] fix: scope IssueListEndpoint to guest created_by

2026-07-08 16:31:58 +05:30

live

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30

proxy

fix: security vulnerabilities for plane docker images (#9140)

2026-05-26 14:25:01 +05:30

space

fix(security): block bot user logins (#9368)

2026-07-08 01:51:37 +05:30

web

fix(security): block bot user logins (#9368)

2026-07-08 01:51:37 +05:30