WS-2023-0260

In the settings of a Mozilla Hub, an admin user can disable the creation an object or move deny to move any object. This is bypassable with the usage of certain / inside the chat feature. An attacker does not to be authenticated nor have joined the room to perform this attack. With some JavaScrip...