HackerOne Disclosed Reports - 2026-04-10

Medium
resolved

Open Redirect in Rocket.Chat

Bug reported by kim soo hyun was disclosed at April 10, 2026, 2:16 am   |   Open Redirect

An open redirect vulnerability was identified in Rocket.Chat. The /_saml/sloRedirect/:provider endpoint included the redirect query string value directly in the Location header for a 302 redirect without any server-side validation. This issue was fixed in v8.4.0.

Medium
resolved

[Vertical Privilege Escalation] User can Unapproved any Approved Translation at [/translations/unapprove/]

Bug reported by was disclosed at April 10, 2026, 1:13 am   |   Privilege Escalation

A vulnerability was discovered in the Pontoon web application where any logged-in user could unapprove any approved translation, regardless of their privileges. This was due to a logical error in the validation logic, which allowed bypassing the authorization check. The vulnerability could be exploited by intercepting the request to the "/translations/unapprove/" endpoint and modifying the necessary parameters.

Low
resolved

User Can Delete Other Users' Personal Access Tokens at /delete-token/{token_id}/ on Mozilla Pontoon

Bug reported by was disclosed at April 10, 2026, 1:12 am   |   Improper Access Control - Generic

A vulnerability was discovered in the Mozilla Pontoon application that allowed users to delete other users' personal access tokens at the /delete-token/{token_id}/ endpoint without proper permission checks. The vulnerability was caused by the absence of user permission verification in the delete_token view function, which allowed anyone to delete any user's personal access token. This could have resulted in users losing access to their accounts if their personal access tokens were deleted.