Manish Gupta 6c9dbb5043 [WEB-7787] fix(security): block deactivated user login and fix WorkspaceOwnerPermission (#9290) ...

GHSA-rmmf-rj2q-3rrg: save_user_data() was unconditionally setting
is_active=True on every login, silently reactivating any admin-deactivated
account. Fix: add an early guard in complete_login_or_signup() that raises
USER_ACCOUNT_DEACTIVATED (5019) before any session or save logic if the
existing user's is_active=False. Remove the is_active=True assignment and
the associated user_activation_email call from save_user_data(). Also
remove the now-unused user_activation_email and base_host imports.

GHSA-wjgv-cq7w-258v: WorkspaceOwnerPermission in both app/permissions/
and utils/permissions/ was filtering WorkspaceMember without is_active=True,
allowing a deactivated workspace owner/admin to retain API access. Add
is_active=True to both copies to match every other permission class.

Co-authored-by: Plane AI <noreply@plane.so>

2026-06-23 18:10:40 +05:30

..

admin

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30

api

[WEB-7787] fix(security): block deactivated user login and fix WorkspaceOwnerPermission (#9290)

2026-06-23 18:10:40 +05:30

live

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30

proxy

…

space

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30

web

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30