Weblate CVE-2025-67492

Requires that the target Weblate instance (version < 5.15) has webhooks enabled (the ENABLE_HOOKS setting) and exposes its service hook endpoint - e.g. the GitHub/GitLab/Bitbucket/Azure hook URLs - to the attacker over the network; these endpoints accept unauthenticated POSTs by design. The exploit specifically abuses the repository 'full_name' value in the payload being used in over-permissive case-insensitive endswith matching (Q(repo__iendswith=full_name) and variants), allowing short or broad names to match many components. The primary LIMITING factor is configuration: setting ENABLE_HOOKS to disable webhooks fully mitigates it, and version 5.15 adds a validate_full_name guard (requires '/' and length > 5) plus exact-match-first logic. No special authentication or user interaction is required where hooks are enabled and reachable.

This is a genuinely moderate, not high-priority, issue and the signals are internally consistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw with only Low confidentiality impact and no integrity or availability impact - matching the GHSA description of an over-permissive webhook endpoint that permits mass repository updates and component enumeration. EPSS reinforces low real-world urgency: 0.26% probability at the 16th percentile indicates exploitation is not currently trending. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. No SSVC decision data was supplied in the input, so that framework cannot be applied here. The one point worth flagging is a mild mismatch between scoring and impact wording: the CVSS records only C:L, but the core described harm is unauthenticated triggering of repository update operations across many components (an integrity/availability-of-state and resource-consumption concern) plus enumeration, so the confidentiality-only scoring arguably understates the operational side while the overall 5.3 severity remains fair.

An attacker who can reach a Weblate instance's publicly exposed webhook (hook) endpoint - which is unauthenticated by design - sends a crafted payload with a repository 'full_name' value chosen to match the server's over-permissive iendswith filter. Because short or broad name fragments matched many components, the single request forces repository update (pull) operations across numerous unrelated projects and reveals which components exist. No public exploit code is identified at time of analysis, but exploitation requires only a basic HTTP POST (AV:N/AC:L).