Manish Gupta 6b0f69ba11 [WEB-8374] fix(security): scope ProjectMemberPreferenceEndpoint to the caller (GHSA-gx67-r6wp-3357) ...

ProjectMemberPreferenceEndpoint.get/patch took a member_id URL param and loaded
the ProjectMember by (project_id, member_id, workspace__slug) with no check that
member_id is the requesting user. Any project member (including a Guest) could
read and modify any other member's per-project preferences by supplying their
member_id.

Preferences are personal — reject any request where member_id != request.user.id
with 403, on both get and patch.

Adds 4 contract tests (cross-member read/write blocked, own read/write allowed);
fail-before verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-24 17:23:13 +05:30

..

admin

chore: clean up React Doctor warnings in admin app (#9418)

2026-07-15 00:47:34 +05:30

api

[WEB-8374] fix(security): scope ProjectMemberPreferenceEndpoint to the caller (GHSA-gx67-r6wp-3357)

2026-07-24 17:23:13 +05:30

live

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30

proxy

fix: security vulnerabilities for plane docker images (#9140)

2026-05-26 14:25:01 +05:30

space

fix(security): block bot user logins (#9368)

2026-07-08 01:51:37 +05:30

web

[GIT-248 | GIT-254] refactor: store and components consolidation to core (#9245)

2026-07-16 13:13:04 +05:30