🎯 New Report #3020021: [Vertical Privilege Escalation User can Unapproved any Approved Translation at /translations/unapprove/](https://hackerone.com/reports/3020021)
🔺Severity: Medium
👽 Reporter: adilnbabras
⭐️ Reputation: 268
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: null
🕐 Submitted: 2025-03-01
⏰ Disclosed: 2026-04-10 01:13:22
📝 Summary: A vulnerability was discovered in the Pontoon web application where any logged-in user could unapprove any approved translation, regardless of their privileges. This was due to a logical error in the validation logic, which allowed bypassing the authorization check. The vulnerability could be exploited by intercepting the request to the "/translations/unapprove/" endpoint and modifying the necessary parameters.
📂 Report JSON File: 3020021
@hackeronereports