🎯 New Report #3325582: User Can Delete Other Users' Personal Access Tokens at /delete-token/{token id}/ on Mozilla Pontoon
🔺Severity: Low
👽 Reporter: adilnbabras
⭐️ Reputation: 268
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: null
🕐 Submitted: 2025-09-03
⏰ Disclosed: 2026-04-10 01:12:47
📝 Summary: A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/{token id}/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the delete token view function, which allowed anyone to delete any user's personal access token. This could have resulted in users losing access to their accounts if their personal access tokens were deleted.
📂 Report JSON File: 3325582
@hackeronereports