Weblate CVE-2026-62326

Exploitation requires an authenticated Weblate account with the built-in 'Edit source' role, which grants write access to source string flags. The malicious pattern must be placed in a 'regex:' or 'placeholders:' quality-check flag on a source string; impact scales with the number of linked target translation units, since Weblate re-evaluates the check for each unit in the same request. Versions prior to 2026.7 are required. Anonymous users, read-only translators, and accounts without the 'Edit source' role cannot exploit this. No special network positioning, non-default configuration, or prior system compromise is required beyond role possession.

The vendor-assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and score of 6.5 accurately captures the threat profile: network-accessible, low complexity, but gated on a low-privilege role with no confidentiality or integrity impact. The PR:L constraint is the most significant limiting factor - anonymous users and read-only translators cannot exploit this, so the attack surface is restricted to accounts explicitly granted the 'Edit source' role. EPSS data was not included in the provided intelligence, and the issue does not appear in CISA KEV, meaning no confirmed active exploitation has been observed. The absence of a public POC further suppresses opportunistic risk. The notable amplification factor - one flag edit re-triggers evaluation across all linked target units in a single synchronous request - means exploitation impact scales with project size, so large community translation projects with many target languages face a higher effective DoS severity than small deployments. Overall this is a genuine patching priority for any Weblate instance with untrusted or externally-sourced contributors, but not an emergency for tightly controlled internal deployments.

An authenticated Weblate contributor holding the 'Edit source' role submits a source string flag such as 'regex:^(a|aa)+$' targeting a source string linked to dozens or hundreds of translated languages. On saving, Weblate synchronously re-evaluates the regex check against every linked target unit in the same HTTP request, triggering exponential backtracking for each unit and pinning one or more server CPU cores. No public POC has been identified, but the technique is well-understood and the attack requires only standard Weblate web UI access.