fix: only return group member count for workspace acl - #26206
Merged
Conversation
Emyrk
approved these changes
Jun 15, 2026
GET /api/v2/workspaces/{id}/acl was authorized only by ActionRead on the
workspace, but escalated to the System context to fetch each ACL group's
full member roster (including member email, last seen, login type, status,
and created at) and returned it directly to the caller. A user merely
shared a workspace could therefore enumerate the PII of every member of
every group on that workspace's ACL.
Return the group identity and total member count only, omitting the member
roster for all callers. This matches the chat ACL and template
available-ACL endpoints, which already use GetGroupMembersCountByGroupIDs
and leave the roster empty.
Addresses ANT-2026-22459.
The workspace ACL endpoint no longer returns each group's member roster to avoid leaking member PII. The sharing status table built its group rows by iterating that roster, so shared groups disappeared from the output entirely. Emit one row per shared group using the group identity and role instead, and add coverage for listing a shared group.
The workspace ACL endpoint no longer returns group member rosters, so the sharing status table lists the shared group itself rather than each member. Update the enterprise test to expect the group row and assert member PII is not exposed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.