Weblate CVE-2025-67715

Requires a valid authenticated account on the target Weblate instance (CVSS PR:L): a low-privileged or self-registered user can call the REST API user-list endpoint (blank/short username query) to enumerate all users, or access another user's notification-subscription objects via the user-notifications endpoint through insecure direct object reference. No special non-default configuration is needed and no user interaction is required, but exploitation is LIMITED to parties who can obtain an account - the fix now returns zero results to ordinary users and 403 to the anonymous user, confirming anonymous callers were already restricted on these paths. Affected versions: Weblate prior to 5.15.

This is a genuine but low-severity authorization flaw, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity issue that nonetheless requires an authenticated low-privileged account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect - matching the advisory's characterization as an IDOR/broken-authorization information-disclosure bug, not a code-execution or takeover primitive. EPSS is low (0.27%, 18th percentile), the CVE is NOT on CISA KEV, and no public exploit or SSVC decision data was provided, so all exploitation-urgency signals point the same way: this is a MEDIUM-severity data-exposure issue, not an active-exploitation priority. The patch is confirmed (merged PR #17256 plus GHSA-3pmh-24wp-xpf4). No signals conflict; the main caveat is that exploitation requires a valid account on the instance, which meaningfully narrows the attacker population versus a truly unauthenticated flaw. Note the input 'Authentication Bypass' tag mischaracterizes the issue - the vendor advisory and CVSS PR:L both confirm authentication is REQUIRED; this is an authorization (IDOR) flaw, not an authentication bypass.

An attacker who holds any low-privileged account on a Weblate instance (self-registered or a limited translator) calls the REST API user-list endpoint with a blank or short query and receives the full roster of users, or dereferences another user's notification subscription via the notifications endpoint. The harvested usernames and email-adjacent metadata are then used to seed phishing, credential-stuffing, or targeted social-engineering against the project's contributors. No public exploit code was identified, but the fix diff plainly documents the vulnerable endpoints.