EUVD-2026-22999
GHSA-mpf5-3vph-q75r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Requires low-privileged access to the API; no user interaction; limited to integrity impact on translation memory.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.
AnalysisAI
Low-privileged users can modify Weblate translation memory via improperly exposed API endpoints in versions prior to 5.17, leading to unauthorized data manipulation without affecting confidentiality or availability. The vulnerability is not known to be actively exploited and has a very low exploitation probability (EPSS 0.01%).
Technical ContextAI
Weblate is a web-based localization tool that exposes a REST API for translation memory management. The vulnerability (CWE-862: Missing Authorization) arose because the API inadvertently exposed endpoints such as POST /api/memory/ and PUT /api/memory/{id}/, which lacked proper access control checks. The affected product, identified by CPE cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:*, allowed unauthorized modifications to shared translation memory data. The fix removed these unintended endpoints and redesigned the API surface as shown in the openapi.yaml changes in the referenced GitHub pull request.
RemediationAI
Upgrade to Weblate 5.17 or later to apply the vendor patch. If immediate upgrade is not possible, block access to the /api/memory/ path in the HTTP server configuration as a workaround, but note that this disables the translation memory feature entirely.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
Remote code execution in Weblate's project backup restoration affects versions prior to 5.17, exploitable by authenticat
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today