sriram veeraghanta 4c1bdd1d62 fix(api): use requester's workspace role for project member role updates (GHSA-x63v-p7wc-47x4) (#9014) ...

is_workspace_admin in ProjectMemberViewSet.partial_update was derived
from the target member's workspace role, not the requester's. When the
target happened to be a workspace admin, all three project-role guards
(L231/238/247) were bypassed regardless of who was making the request,
allowing a non-admin requester to re-role a workspace admin's project
membership. Compute is_workspace_admin from the requester instead and
keep the target's workspace role under a distinct name for the existing
new-role-vs-workspace-role cap.

2026-05-05 16:35:28 +05:30

..

bin

…

plane

fix(api): use requester's workspace role for project member role updates (GHSA-x63v-p7wc-47x4) (#9014)

2026-05-05 16:35:28 +05:30

requirements

…

templates

…

.coveragerc

…

.env.example

…

.prettierignore

…

Dockerfile.api

…

Dockerfile.dev

…

manage.py

…

package.json

…

pyproject.toml

…

pytest.ini

…

requirements.txt

…

run_tests.py

…

run_tests.sh

…