HackerOne Disclosed Reports - 2026-05-25

High
resolved

Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access Check

Bug reported by Sukhbat was disclosed at May 25, 2026, 2:10 pm   |   Insecure Direct Object Reference (IDOR)