HexBrain

Weblate · Report #1454552

hosted.weblate.org display of unfiltered results

Informativestatus
3upvotes
21 Jan 2022disclosed

How it was found

able to request all changes of everything not just sandbox when inserting this %'s in author username on this page. https://hosted.weblate.org/changes/?project=sandbox&lang=en&user=%25%27s&start_date=&end_date=

Impact

no filter on request feels like elevated permissions. lets you do the search even though it throws error.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original