![[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]](/hackerone-cover.png)
Improper Access Control - Generic (CWE-284)CVSS 6.5€0
[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]
adilnbabras
Disclosed on HackerOne · April 10, 2026
Publicly disclosed report · by adilnbabras
View original on HackerOneHi, team. During testing, I discovered that only privileged users or translation owners can unapprove an approved translation, but due to logical errors, any logged-in user can unapprove any approved translation.
Steps To Reproduce:
-
Go to
https://mozilla-pontoon-staging.herokuapp.com/and log in to your account. -
Click on
Teamsand select any team from the menu.
![]()
![]()