Manish Gupta 96d4ae95f0 [INFRA-778] fix(security): scope ExportIssuesEndpoint.get to the requesting user's own exports ...

ExportIssuesEndpoint.get filtered ExporterHistory by workspace__slug only,
with no initiated_by filter, so any workspace ADMIN/MEMBER could list
every other member's export history. ExporterHistorySerializer includes
url (a presigned S3 link, 7-day expiry, no auth required to use) and
token. Since an export defaults to the initiator's own projects
(including fully private ones) when no project list is supplied, any
workspace member could read another member's private project data by
listing exports and using the disclosed url — no crafted request needed,
and revoking the user's access doesn't revoke the download.

Add initiated_by=request.user to the queryset filter, per the advisory's
own suggested fix. 2 new tests, fail-before verified.

Co-authored-by: Plane AI <noreply@plane.so>

2026-08-28 15:28:23 +05:30

..

admin

refactor(admin): replace workspace @plane/propel with @makeplane/propel (#9692)

2026-08-27 23:59:07 +05:30

api

[INFRA-778] fix(security): scope ExportIssuesEndpoint.get to the requesting user's own exports

2026-08-28 15:28:23 +05:30

live

chore: dump version

2026-08-16 23:36:30 +05:30

proxy

fix: security vulnerabilities for plane docker images (#9140)

2026-05-26 14:25:01 +05:30

space

chore: upgrade React to 19 and React Router to 8 (#9530)

2026-08-26 17:39:36 +05:30

web

refactor: migrate web Tooltip to @makeplane/propel Tooltip (#9697)

2026-08-28 00:11:19 +05:30