Ibrahimmrpl

An issue exists where the endpoint "/api/v1/workspaces/{slug}/projects/{project id}/members/" returns the complete project-member roster, including email addresses, names, avatars, and roles. The `ProjectMemberPermission` check only verifies if the caller is an active member of any project within the workspace, failing to bind the check to the specific `project id`. As a result, any authenticated user, including those with Guest roles, can access the member list of other private projects within the same workspace by manipulating the `project id` variable in the URL.

An issue exists where the server can be coerced into making requests to internal resources during organization domain HTTP verification. This occurs because the challenge fetch process utilizes the default `http.Get` function in Go instead of a protected client. Attackers can register domains that redirect to loopback, internal, or cloud metadata addresses, enabling them to scan ports and map internal networks. This is a server-side request forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.