From 37ff1b8cabcdb7d3883a9eaaeb49e56375623d6d Mon Sep 17 00:00:00 2001 From: sriram veeraghanta Date: Wed, 4 Feb 2026 16:30:18 +0530 Subject: [PATCH] [SECUR-103] fix: Insecure Direct Object Reference on feature flags endpoint#5718 --- apps/api/plane/payment/views/feature_flag.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apps/api/plane/payment/views/feature_flag.py b/apps/api/plane/payment/views/feature_flag.py index 1541d769f1..4e69a9b2d3 100644 --- a/apps/api/plane/payment/views/feature_flag.py +++ b/apps/api/plane/payment/views/feature_flag.py @@ -27,9 +27,12 @@ from plane.payment.views.base import BaseAPIView from plane.db.models import DeployBoard from plane.utils.exception_logger import log_exception from plane.space.rate_limit import AnchorBasedRateThrottle, SpaceRateThrottle +from plane.app.permissions.workspace import WorkspaceUserPermission class FeatureFlagProxyEndpoint(BaseAPIView): + permission_classes = [WorkspaceUserPermission] + def get(self, request, slug): try: url = f"{settings.FEATURE_FLAG_SERVER_BASE_URL}/api/feature-flags/"