Weblate CVE-2026-61790

Exploitation requires three concurrent conditions: (1) the Weblate instance has at least one team with the enforced_2fa flag set to True; (2) that team has been granted a site-wide global permission (such as management.use); and (3) the exploiting user is a human member of that team who has not configured a two-factor authentication device. Bot users are explicitly exempt from the 2FA check by design and are not affected. The vulnerability does not apply to project-, component-, or workspace-scoped permissions, which were already correctly gated. Exploitation is further limited by the need for an attacker to already be an authenticated, team-assigned user - unauthenticated access is not possible.

The provided CVSS vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) scores 4.4 and reflects a moderate, network-accessible flaw requiring high privileges, which is broadly consistent with the description - the user must already be a member of a privileged team granted global permissions. However, PR:H warrants scrutiny: the attacker is a legitimate authenticated user placed into a team by an administrator, which arguably maps closer to PR:L than PR:H, since the user does not themselves need to hold administrative access prior to exploitation. EPSS data was not provided, and there is no CISA KEV listing, so no signals of active exploitation exist beyond the vendor's own disclosure. The realistic risk is narrow: it requires an administrator to have created a team with both enforced_2fa and a global permission grant, and a user in that team who hasn't yet enrolled a TOTP device. That combination is plausible in organizations transitioning to mandatory 2FA - a window during rollout where users are added to teams before completing enrollment. The actual impact, unauthorized access to the /manage/ interface, is significant for a Weblate instance managing sensitive translation workflows or internal tooling, but the constrained preconditions limit widespread exposure.

An administrator creates a team named 'Site Managers' with enforced_2fa=True and grants it the global management.use permission, then adds a newly onboarded user to the team before that user completes 2FA enrollment. The user, without configuring a TOTP device, navigates to /manage/ and gains access to the site management interface, bypassing the intended 2FA gate entirely. No public exploit code exists; the flaw is exploitable by any authenticated user in this state using a standard browser.