fix: IDOR in IssueBulkUpdateDateEndpoint (GHSA-4q54-h4x9-m329) by sriramveeraghanta · Pull Request #8834 · makeplane/plane

sriramveeraghanta · 2026-03-31T11:54:48Z

Summary

Fixes an IDOR vulnerability in IssueBulkUpdateDateEndpoint where the issue query was not scoped to the current workspace and project
An authenticated user with ADMIN or MEMBER role in any project could modify start_date and target_date of issues in any other workspace/project across the entire instance
Scoped the Issue.objects.filter() query to include workspace__slug and project_id, consistent with all other issue endpoints

Security Details

Advisory: GHSA-4q54-h4x9-m329
CWE: CWE-639 (Authorization Bypass Through User-Controlled Key)
CVSS: 6.5 (Medium)
File: apps/api/plane/app/views/issue/base.py

Root Cause

The query at line 1121 used Issue.objects.filter(id__in=issue_ids) without constraining by workspace__slug=slug and project_id=project_id. This allowed cross-workspace/cross-project issue date modification.

Fix

- issues = list(Issue.objects.filter(id__in=issue_ids))
+ issues = list(Issue.objects.filter(id__in=issue_ids, workspace__slug=slug, project_id=project_id))

Test plan

Verify bulk date updates still work for issues within the user's own project
Verify that attempting to update issues from another project/workspace results in those issues being silently skipped (not found by the scoped query)
Verify that the endpoint returns 200 with no modifications when all provided issue IDs belong to other projects

Summary by CodeRabbit

Bug Fixes
- Fixed bulk date updates for issues to correctly scope to the specified workspace and project, preventing unintended updates to issues outside the current scope.

The bulk update date endpoint fetched issues by ID without filtering by workspace or project, allowing any authenticated project member to modify start_date and target_date of issues in any workspace/project across the entire instance (IDOR - CWE-639). Scoped the query to include workspace__slug and project_id filters, consistent with other issue endpoints in the codebase. Ref: GHSA-4q54-h4x9-m329 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-03-31T11:55:05Z

📝 Walkthrough

Walkthrough

The bulk issue date update endpoint now applies additional filtering constraints (workspace__slug=slug and project_id=project_id) when fetching issues to ensure updates only affect issues within the specified workspace and project scope.

Changes

Cohort / File(s)	Summary
Bulk Issue Update Date Filtering `apps/api/plane/app/views/issue/base.py`	Added workspace and project constraints to the bulk issues queryset in `IssueBulkUpdateDateEndpoint.post` to prevent updates from applying to mismatched issues.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A filter most true, now guards the date,
Making sure issues stay in their workspace estate,
No cross-project chaos, no scope gone astray,
Just safe bulk updates in the proper way! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the primary change: fixing an IDOR vulnerability in IssueBulkUpdateDateEndpoint, with direct reference to the security advisory.
Description check	✅ Passed	The PR description includes all required sections: a clear Summary, detailed Security Details (Advisory, CWE, CVSS), Root Cause analysis, the specific code Fix with diff, and a comprehensive Test Plan. It comprehensively covers the IDOR vulnerability, its impact, and the resolution.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/idor-bulk-update-date-endpoint

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Fixes an insecure direct object reference (IDOR) in the API endpoint that bulk-updates issue start_date / target_date by ensuring the issue lookup is scoped to the current workspace and project.

Changes:

Scope IssueBulkUpdateDateEndpoint bulk issue fetch to workspace__slug and project_id to prevent cross-workspace/project updates.

Copilot · 2026-03-31T12:00:34Z

        # Fetch all relevant issues in a single query
-        issues = list(Issue.objects.filter(id__in=issue_ids))
+        issues = list(Issue.objects.filter(id__in=issue_ids, workspace__slug=slug, project_id=project_id))
        issues_dict = {str(issue.id): issue for issue in issues}


This endpoint fetches issues via the default Issue.objects manager. Unlike Issue.issue_objects, this will include triage/archived/draft issues (see IssueManager.get_queryset()), which is inconsistent with other issue endpoints in this file that operate on Issue.issue_objects. If bulk date updates should only apply to “active” issues, consider switching this query to Issue.issue_objects.filter(...) (and keep the same workspace/project scoping). If the broader scope is intentional, it’d help to document why here to avoid future authorization/behavior inconsistencies.

…makeplane#8834) The bulk update date endpoint fetched issues by ID without filtering by workspace or project, allowing any authenticated project member to modify start_date and target_date of issues in any workspace/project across the entire instance (IDOR - CWE-639). Scoped the query to include workspace__slug and project_id filters, consistent with other issue endpoints in the codebase. Ref: GHSA-4q54-h4x9-m329 (cherry picked from commit a01b51f)

…makeplane#8834) The bulk update date endpoint fetched issues by ID without filtering by workspace or project, allowing any authenticated project member to modify start_date and target_date of issues in any workspace/project across the entire instance (IDOR - CWE-639). Scoped the query to include workspace__slug and project_id filters, consistent with other issue endpoints in the codebase. Ref: GHSA-4q54-h4x9-m329

Copilot AI review requested due to automatic review settings March 31, 2026 11:54

Copilot started reviewing on behalf of sriramveeraghanta March 31, 2026 11:55 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

pablohashescobar approved these changes Mar 31, 2026

View reviewed changes

sriramveeraghanta merged commit a01b51f into preview Mar 31, 2026
15 of 16 checks passed

sriramveeraghanta deleted the fix/idor-bulk-update-date-endpoint branch March 31, 2026 12:13

Navigation Menu

Uh oh!

fix: IDOR in IssueBulkUpdateDateEndpoint (GHSA-4q54-h4x9-m329) - #8834

fix: IDOR in IssueBulkUpdateDateEndpoint (GHSA-4q54-h4x9-m329)#8834
sriramveeraghanta merged 1 commit into
previewfrom
fix/idor-bulk-update-date-endpoint

sriramveeraghanta commented Mar 31, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Mar 31, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

sriramveeraghanta commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security Details

Root Cause

Fix

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sriramveeraghanta commented Mar 31, 2026 •

edited

Loading

coderabbitai Bot commented Mar 31, 2026 •

edited

Loading