Tolgee is an open-source localization platform. For the /v2/projects/translations
and /v2/projects/{projectId}/translations
endpoints, translation data was returned even when API key was missing translation.view
scope. However, it was impossible to fetch the data when user was missing this scope. So this is only relevant for API keys generated by users permitted to translation.view
. This vulnerability is fixed in v3.57.2