Privilege escalation (PR) from edit in multilingual wikis via translations

Steps to reproduce:

1. In a multilingual wiki, as a user without script or admin right, edit a translation of AppWithinMinutes.Translations.
2. In the line "platform.appwithinminutes.description=" add the following at the end:

   {{async}}{{groovy}}println("Hello from Translation"){{/groovy}}{{/async}}

   

3. Save
4. Open the app within minutes page (AppWithinMinutes.WebHome) in the same locale.

Expected result:

Translations are broken as they were edited by a user without the necessary right.

Actual result:

Translations are still displayed and the content "Hello from Translation" is displayed at the end of the introduction.

This vulnerability is probably quite old, the affects version needs to be determined. This also exploits unescaped translations like XWIKI-19749 but through a different vector (editing existing translations without invalidating the author).