HackerOne Disclosed Reports - 2026-04-09

Medium
resolved

Open Redirect in Rocket.Chat

Bug reported by kim soo hyun was disclosed at April 10, 2026, 2:16 am   |   Open Redirect

An open redirect vulnerability was identified in Rocket.Chat. The /_saml/sloRedirect/:provider endpoint included the redirect query string value directly in the Location header for a 302 redirect without any server-side validation. This issue was fixed in v8.4.0.

Medium
resolved

[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]

Bug reported by was disclosed at April 10, 2026, 1:13 am   |   Privilege Escalation

A vulnerability was discovered in the Pontoon web application where any logged-in user could unapprove any approved translation, regardless of their privileges. This was due to a logical error in the validation logic, which allowed bypassing the authorization check. The vulnerability could be exploited by intercepting the request to the "/translations/unapprove/" endpoint and modifying the necessary parameters.

Low
resolved

User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon

Bug reported by was disclosed at April 10, 2026, 1:12 am   |   Improper Access Control - Generic

A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/{token_id}/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the delete_token view function, which allowed anyone to delete any user's personal access token. This could have resulted in users losing access to their accounts if their personal access tokens were deleted.

Medium
resolved

Memory leak in gem decode logic can allow attacker to take down Rubygems.org application

Bug reported by was disclosed at April 9, 2026, 11:46 am   |   Uncontrolled Resource Consumption

A memory leak vulnerability was discovered in the gem decode logic of the Rubygems.org application. The vulnerability allowed an attacker with a valid API key to set arbitrary instance variables during the decoding of gem metadata, which would cause the server to exhaust its memory. The issue was addressed by restricting the instance variables that can be set during metadata decoding.