HackerOne Disclosed Reports - 2026-11-14

Low
resolved

Anonymous Translation Suggestion IP Address Exposure Through Change API

Bug reported by 4upasta was disclosed at November 15, 2026, 6:57 am   |   Information Disclosure

A vulnerability was identified where the IP address associated with anonymous translation suggestions was exposed through the Change API to authenticated users with read-only project access. The IP address was stored in change details and returned by the API, but was not displayed in the regular change-history interface. The issue was confirmed in local testing against a specific commit version. No live servers or real user data were involved in the testing.

Critical
resolved

Privilege escalation via unfiltered role restoration in project backup import

Bug reported by Zukosdead was disclosed at November 15, 2026, 5:16 am   |   Privilege Escalation

A privilege escalation vulnerability was discovered in project backup import functionality. When restoring access-control teams from backup files, roles carrying global site-wide permissions were not validated and could be attached to project-scoped teams without proper filtering. This allowed users with limited backup import privileges to gain unauthorized site-wide permissions. Additionally, a separate issue in the permissions collection logic failed to exclude project-scoped team memberships when determining global permissions, allowing the escalated privileges to take effect across the entire site. The vulnerability was confirmed through multiple reproduction tests demonstrating that low-privilege users could obtain administrative capabilities after importing a crafted backup file.