Weblate CVE-2026-33212

Exploitation requires: (1) valid authentication credentials for the target Weblate instance - any user account suffices (PR:L); (2) the target task must be in a PENDING or in-flight state at the time of the request, as completed tasks already had result-based permission checks applied in the old code; (3) successful brute-force of the randomly assigned 128-bit task UUID within the task's execution window before it completes. Exploitation is limited by Weblate's default API rate limiting (cited by the vendor as the primary mitigation), the vast 128-bit UUID search space that makes guessing statistically infeasible, the narrow time window during which a task is pending, and the low-sensitivity nature of the exposed data (task logs rather than credentials or privileged data). Impact is strictly limited to confidentiality of in-progress task log output with no integrity, availability, or lateral movement consequence.

The official CVSS 3.1 score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the genuine difficulty of exploitation - an attacker must hold a valid session and successfully guess a 128-bit random UUID before the target task completes or expires. SSVC assigns Exploitation: none and Automatable: no, reinforcing that this is not a high-priority remediation item, and even a mid-sized municipal IT team in inowroclaw running Weblate for localization projects would face negligible practical exposure given default API rate limiting. EPSS at 0.03% (7th percentile) confirms very low real-world risk. The primary concern is partial information disclosure of in-progress task logs - no integrity, availability, or authentication impact is present, and the data exposed is operational metadata rather than credentials or sensitive user content.

An authenticated Weblate user with limited project access repeatedly calls the task-detail API endpoint with randomly generated UUIDs, attempting to match the UUID of a pending background task associated with a restricted component. If a UUID collision is achieved while the task is still in-flight and before API rate limits terminate the session, the attacker receives task progress logs that may reveal file paths, translation content, or operational metadata belonging to a component they are not authorized to view.