Privacy Policy Terms of Service

getWorkspaceUsers Authorization Fix Report

Validation of workspace member access control

Authorization Model

Previous (Broken): Only admin/owner could call getWorkspaceUsers

→ Staff users got 403 Forbidden


Fixed (New): Any active workspace member can call getWorkspaceUsers for their workspace

→ Check: WorkspaceMember.exists(user_id, workspace_id, is_active=true)


Isolation: Non-members receive 403 for workspaces they don't belong to

Click "Run Validation" to test workspace member authorization