User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon

Hi team, while reviewing the Mozilla Pontoon source code, I have found that a new feature has been added to Generate and Delete Personal Access Tokens for the Rest API. To Delete a token, a user sends a POST request to /delete-token/{token_id}/ endpoint with the numeric token ID. The developer forgot to put a check on user permissions at this endpoint, which allows a user to delete anyone's Personal Access Token.

Steps To Reproduce:

• Log in to your Victim account at https://mozilla-pontoon-staging.herokuapp.com/.

• On the top right corner, click on your profile icon and from the dropdown menu, click on settings.

███████

• Prepare your proxy, like Burp Suite, to capture incoming requests and change your display name.