EUVD-2026-66712
GHSA-2p9g-x3cv-5hh4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoints require a valid authenticated session (PR:L); only object existence is inferrable, yielding Low confidentiality impact with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
AnalysisAI
Object existence enumeration in Weblate prior to version 2026.7 allows authenticated low-privilege users to infer whether objects exist within private projects by observing differential HTTP response codes - HTTP 403 (Forbidden) for existing-but-inaccessible objects versus HTTP 404 (Not Found) for truly absent ones. Affected endpoints performing globally-scoped ORM lookups across changes, comments, and announcements fail to restrict results to projects the requesting user is authorized to view. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least low-privilege access to the target Weblate instance (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N scores 4.3 (Medium) and accurately captures the threat profile: network-reachable, low complexity, but gated by prior authentication (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading Weblate to version 2026.7 or later, which contains the hardened object lookup logic confirmed by commit 836bc082803d49d02f2831ec8339268eb66bcdae and documented in the vendor advisory at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2p9g-x3cv-5hh4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS,
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today