Privilege EscalationCVSS 6.5Medium

[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]

hackerone-reports

April 11, 2026

3 views

Save

€0

Vulnerability Summary

HackerOne disclosed report --> https://hackerone.com/reports/3020021 by adilnbabras

Hi, team. During testing, I discovered that only privileged users or translation owners can unapprove an approved translation, but due to logical errors, any logged-in user can unapprove any approved translation.

Steps To Reproduce:

Go to https://mozilla-pontoon-staging.herokuapp.com/ and log in to your account.
Click on Teams and select any team from the menu.

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

LogicalBreach Academy

[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]

Steps To Reproduce:

Identification Required

Discussion