🔺Severity: Medium
👽 Reporter: josan george
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-05-05
⏰ Disclosed: 2026-05-18 00:37:59
📝 Summary: The
/api/v1/autotranslate.translateMessage endpoint allowed any authenticated user to retrieve the full content of any message from any room, including private groups, direct messages, and channels. The endpoint fetched the message without performing a room access check, returning the complete message object including the message text, sender information, room ID, timestamps, and markdown content.📂 Report JSON File: 3713682
@hackeronereports