Weblate CVE-2025-64725

Exploitation requires that a victim Weblate user has an invitation opened in their authenticated session and leaves that session/invitation unattended (the vendor's own workaround is to avoid leaving Weblate sessions with an invitation opened unattended). A different user must then act against that opened invitation context, so the attack needs local access to the victim's session (AV:L), low-level authenticated privileges (PR:L), a specific precondition of an already-opened invitation (AT:P), and passive victim interaction (UI:P). Limiting factors: it is not remotely/network exploitable against defaults, it is high-complexity, and it only works in the window where an invitation is open and the session is exposed - substantially constraining real-world risk.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:P) with a base score of 1.0 describes a local-vector flaw with high attack complexity, a specific attack requirement (AT:P), required low-level privileges, and passive user interaction - all pointing to a narrow, opportunistic scenario rather than a scalable attack. EPSS is 0.35% (26th percentile), reinforcing low expected exploitation. The flaw is NOT in CISA KEV, and no public exploit code is referenced in the provided data, so this is no public exploit identified at time of analysis. The GitHub Security Advisory (GHSA-m6hq-f4w9-qrjj) and commit diff confirm the root cause: the invitation-acceptance view lacked a validate_invitation ownership check (CWE-286), letting one authenticated user accept an invitation opened in another user's context. No SSVC decision data was provided in the input. Note the 'Information Disclosure' tag is a poor fit - the actual impact is improper authorization/ownership of an invitation, not data leakage; this is a mild mismatch, not a correction I can make with high confidence. Overall: a high-CVSS alarm is absent here (CVSS is correctly low), and this is a defense-in-depth fix, not an urgent patch.

An authenticated Weblate user who leaves their session with an invitation page opened and unattended could have that invitation accepted by a different user who gains access to that opened session or invitation context, binding the invitation to the wrong account. Because the CVSS vector is local (AV:L), high-complexity (AC:H), and requires passive user interaction (AT:P/UI:P), realistic exploitation depends on the victim first opening the invitation and then exposing that session. No public proof-of-concept is referenced in the provided data.