diff --git a/apps/api/plane/app/views/project/member.py b/apps/api/plane/app/views/project/member.py index 7dfe709001..e747f573e7 100644 --- a/apps/api/plane/app/views/project/member.py +++ b/apps/api/plane/app/views/project/member.py @@ -206,11 +206,15 @@ class ProjectMemberViewSet(BaseViewSet): def partial_update(self, request, slug, project_id, pk): project_member = ProjectMember.objects.get(pk=pk, workspace__slug=slug, project_id=project_id, is_active=True) - # Fetch the workspace role of the project member - workspace_role = WorkspaceMember.objects.get( + # Fetch the target's workspace role (used to cap the new project role) + target_workspace_role = WorkspaceMember.objects.get( workspace__slug=slug, member=project_member.member, is_active=True ).role - is_workspace_admin = workspace_role == ROLE.ADMIN.value + # Fetch the requester's workspace role to decide if they may bypass project-role checks + requester_workspace_role = WorkspaceMember.objects.get( + workspace__slug=slug, member=request.user, is_active=True + ).role + is_workspace_admin = requester_workspace_role == ROLE.ADMIN.value # Check if the user is not editing their own role if they are not an admin if request.user.id == project_member.member_id and not is_workspace_admin: @@ -251,7 +255,7 @@ class ProjectMemberViewSet(BaseViewSet): ) # Cannot assign a role higher than the target's workspace role - if workspace_role in [5] and new_role in [15, 20]: + if target_workspace_role in [5] and new_role in [15, 20]: return Response( {"error": "You cannot add a user with role higher than the workspace role"}, status=status.HTTP_400_BAD_REQUEST,