[WEB-8332] fix(security): block workspace-member mass-assignment by mguptahub · Pull Request #9460 · makeplane/plane

mguptahub · 2026-07-22T11:49:43Z

Summary

CRITICAL — fixes a cross-tenant workspace takeover (WEB-8332). Confirmed-vulnerable on origin/preview.

WorkSpaceMemberViewSet.partial_update passed request.data straight into WorkSpaceMemberSerializer (fields = "__all__", only nested member read-only). workspace, role, and is_active were therefore mass-assignable. An admin of an attacker-owned workspace could PATCH a member row setting workspace=victim-workspace UUID and role=20 → relocate a controlled account into the victim workspace as an admin with no invitation. Since all authorization derives from WorkspaceMember(workspace, member, role, is_active) rows, this is a full cross-tenant takeover. @allow_permission([ADMIN], level="WORKSPACE") authorizes against the URL slug but does not stop the write from moving the row elsewhere.

Fix

The endpoint's only legitimate mutation is role, so the writable payload is restricted to {"role": ...} in the view:

allowed_data = {}
if "role" in request.data:
    allowed_data["role"] = request.data.get("role")
serializer = WorkSpaceMemberSerializer(workspace_member, data=allowed_data, partial=True)

Why not fields=("id","member","role")? DynamicBaseSerializer.__init__ pops the fields= kwarg and immediately overwrites it with self.expand (serializers/base.py), so fields= never restricts writes or output. The view-level allowlist is the reliable fix and is the only write path through this serializer (list/retrieve are read-only), so no other consumer is affected. The self-role-update guard and guest role-cascade are preserved; is_active is only changed via destroy().

Tests

New tests/contract/app/test_workspace_member_mass_assignment_app.py — 4 cases (cross-workspace move blocked; is_active=false no-ops; legitimate role update works; self-update still 400). Fail-before verified on the CE docker test stack: 2 attack tests failed unpatched → 4 pass patched; 12/12 in a regression run with sibling member/authz suites.

Related finding (separate ticket — NOT in this PR)

The root cause exposed a latent bug: DynamicBaseSerializer's fields= kwarg is discarded (base.py: fields = self.expand), so every caller that passes fields=(...) expecting to limit output (e.g. list/retrieve here) actually returns all model columns. That's an app-wide over-disclosure surface needing its own scoped audit + FE-compat check — filed separately; deliberately not touched here (changing base.py would enforce output filtering app-wide and likely break the frontend).

Summary by CodeRabbit

Bug Fixes
- Workspace member PATCH is now restricted to role-only updates, preventing unauthorized changes to other fields (including workspace association and deactivation).
- Attempts to move a member to another workspace via PATCH are blocked, and related role effects no longer impact unrelated membership.
- Non-integer role inputs now return a client error without cascading guest-role behavior.
Tests
- Added contract regression coverage for mass-assignment prevention, ignored deactivation attempts, valid role updates, self-role restrictions, and error handling.

…A-f739-39g5-jj49) WorkSpaceMemberViewSet.partial_update passed request.data verbatim into WorkSpaceMemberSerializer (fields="__all__"), making workspace, role, and is_active mass-assignable. A workspace admin could PATCH a member row setting workspace=<victim UUID> and role=20, relocating a controlled account into the victim workspace as admin — full cross-tenant takeover. The endpoint's only legitimate mutation is `role`, so restrict the writable payload to {"role": ...}. Note: passing fields=("id","member","role") does NOT work — DynamicBaseSerializer discards the fields= kwarg (base.py) — so the allowlist is enforced in the view instead. Preserves the self-role-update guard and the guest role-cascade. is_active is only changed via destroy(), not here. Adds 4 contract tests; fail-before verified (2 attack tests failed unpatched → 4 pass). Co-authored-by: Plane AI <noreply@plane.so>

coderabbitai · 2026-07-22T11:50:34Z

Warning

Review limit reached

@mguptahub, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 46 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 881eff38-917c-4557-b91e-4d4dd1604740

📥 Commits

Reviewing files that changed from the base of the PR and between 63d1515 and ded0e06.

📒 Files selected for processing (2)

apps/api/plane/app/views/workspace/member.py
apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py

📝 Walkthrough

Walkthrough

Workspace member partial updates now whitelist role, validate before side effects, and save role changes with related guest-role updates atomically. Contract tests cover mass-assignment prevention, valid and invalid roles, ignored activation changes, and self-update restrictions.

Changes

Workspace member update security

Layer / File(s)	Summary
Restrict and validate workspace member PATCH fields `apps/api/plane/app/views/workspace/member.py`	`partial_update` accepts only `role`, validates it before cascading changes, and atomically saves the workspace member and guest-role updates.
Validate update boundaries `apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py`	Contract tests verify cross-workspace reassignment and deactivation are ignored, legitimate role updates succeed, self-role updates remain forbidden, and invalid roles return `400` without cascading changes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

makeplane/plane#9367: Both changes harden member partial updates against unauthorized activation changes.

Suggested reviewers: pablohashescobar, dheeru0198

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the security fix for workspace-member mass assignment and includes the related issue identifier.
Description check	✅ Passed	The description explains the vulnerability, fix, scope, preserved behavior, tests, and related finding in sufficient detail.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch web-8332/workspace-member-mass-assignment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

makeplane · 2026-07-22T11:50:44Z

Linked to Plane Work Item(s)

(WEB-8332) (security) CE — Cross-tenant workspace takeover via member-PATCH mass-assignment (GHSA-f739-39g5-jj49)

This comment was auto-generated by Plane

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py`:
- Around line 99-107: Extend the mixed-payload assertions in the workspace
member update test to verify that the permitted role change is applied by
asserting puppet_member.role equals 20 after refresh_from_db(), while retaining
the existing assertions that the workspace remains unchanged and no victim
member is created.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 65e256f5-7f4d-4580-8509-f4bf08174ff0

📥 Commits

Reviewing files that changed from the base of the PR and between a8e53b6 and 46670e6.

📒 Files selected for processing (2)

apps/api/plane/app/views/workspace/member.py
apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py

Copilot

Pull request overview

This PR addresses a critical security vulnerability (GHSA-f739-39g5-jj49 / WEB-8332) where WorkSpaceMemberViewSet.partial_update allowed workspace admins to mass-assign sensitive WorkspaceMember fields (e.g. workspace, is_active) and perform cross-tenant workspace takeover by relocating a controlled member row into another workspace.

Changes:

Restricts WorkSpaceMemberViewSet.partial_update to only accept role in the writable payload (view-level allowlist).
Adds contract regression tests covering the mass-assignment takeover vector and ensuring intended role updates still work.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
apps/api/plane/app/views/workspace/member.py	Adds a view-level allowlist to prevent mass-assignment of `WorkspaceMember` fields via PATCH.
apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py	Adds contract regression tests to prevent cross-workspace moves and verify allowed role updates.

…opilot #9460) partial_update cascaded the guest project-role downgrade BEFORE the serializer was validated/saved, using a manual int() cast that 500s on non-integer input. Reorder: validate the serializer first, then cascade using serializer.validated_data["role"] inside a transaction.atomic() with save(), so a bad role returns 400 (not 500) and project roles can't be downgraded when the member update doesn't persist. Adds a non-integer-role 400 test. Co-authored-by: Plane AI <noreply@plane.so>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py`:
- Around line 162-179: Extend test_non_integer_role_is_400_not_500 by creating a
related ProjectMember for target_member with a non-guest role before the invalid
PATCH, then refresh it and assert its role remains unchanged alongside
target_member.role. Use the existing project-member creation helpers and role
symbols visible in the test module.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1339de50-6ecc-41a5-857f-0a45edaba3bb

📥 Commits

Reviewing files that changed from the base of the PR and between 46670e6 and ea8a667.

📒 Files selected for processing (2)

apps/api/plane/app/views/workspace/member.py
apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py

🚧 Files skipped from review as they are similar to previous changes (1)

apps/api/plane/app/views/workspace/member.py

…id update (CodeRabbit #9460) Address two CodeRabbit review comments: - Mixed-payload takeover test now also asserts the permitted field (role) in the same payload WAS applied (role == 20), proving the fix filters the payload rather than rejecting it wholesale. - test_non_integer_role_is_400_not_500 now seeds a non-guest ProjectMember and asserts it stays role 15 after the invalid PATCH, so a regression that let the guest project-role cascade run on a failed update would be caught. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

…ld (Copilot #9460) When a PATCH carries only forbidden keys (e.g. {"is_active": false}), allowed_data is empty and the previous code still called serializer.save() — a no-op write that bumped updated_at/updated_by and ran through the save path for nothing. Early-return the current serialized member (200) when there are no allowed fields, so a forbidden-only payload has no side effects. Strengthened the is_active test to assert updated_at is unchanged (fail-before verified). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Explanations kept unchanged; only the IDs are removed. Co-authored-by: Plane AI <noreply@plane.so>

github-actions · 2026-08-07T10:35:36Z

React Doctor found 4 issues in 4 files · 1 error & 3 warnings · score 82 / 100 (Needs work) · vs preview

Errors

❌ core/components/pages/editor/editor-body.tsx:194 Server and client render different branches no-hydration-branch-on-browser-global

3 warnings

core/components/issues/issue-layouts/spreadsheet/columns/label-column.tsx

⚠️ L14 Import from a barrel file no-barrel-import

core/components/issues/peek-overview/properties.tsx

⚠️ L42 Import from a barrel file no-barrel-import

core/components/issues/workspace-draft/draft-issue-properties.tsx

⚠️ L31 Import from a barrel file no-barrel-import

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against preview to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on preview.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit ded0e06. See inline comments for fixes.}

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot AI lite review requested due to automatic review settings July 22, 2026 11:49

mguptahub requested review from dheeru0198 and pablohashescobar as code owners July 22, 2026 11:49

Copilot started reviewing on behalf of mguptahub July 22, 2026 11:50 View session

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread apps/api/plane/app/views/workspace/member.py Outdated

Copilot AI review requested due to automatic review settings July 22, 2026 12:25

Copilot started reviewing on behalf of mguptahub July 22, 2026 12:26 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py

Copilot AI review requested due to automatic review settings July 23, 2026 09:18

Copilot started reviewing on behalf of mguptahub July 23, 2026 09:19 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread apps/api/plane/app/views/workspace/member.py

Copilot AI review requested due to automatic review settings July 23, 2026 09:28

Copilot started reviewing on behalf of mguptahub July 23, 2026 09:28 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

mguptahub changed the title ~~[WEB-8332] fix(security): block workspace-member mass-assignment (GHSA-f739-39g5-jj49)~~ [WEB-8332] fix(security): block workspace-member mass-assignment Aug 7, 2026

chore(security): drop advisory identifiers from code comments

ded0e06

Explanations kept unchanged; only the IDs are removed. Co-authored-by: Plane AI <noreply@plane.so>

Copilot AI review requested due to automatic review settings August 7, 2026 10:34

Copilot started reviewing on behalf of mguptahub August 7, 2026 10:35 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Uh oh!

Conversation

mguptahub commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Tests

Related finding (separate ticket — NOT in this PR)

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

makeplane Bot commented Jul 22, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mguptahub commented Jul 22, 2026 •

edited

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading