EUVD-2026-66720Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible feed endpoint with no authentication required on default anonymous-access installations; confidentiality impact is low and bounded to metadata, with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations that permit anonymous access, this metadata can be retrieved without any authentication. The exposed information can include project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, though translated-string content is not included in the feed. Installations using private projects or restricted components are affected. This issue is fixed in version 2026.8.
AnalysisAI
Object-scoped RSS feeds in Weblate prior to version 2026.8 bypass the platform's permission model, exposing change-history metadata from private projects and restricted components to any requester - including unauthenticated users on installations that permit anonymous access. The exposed metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and translation unit links, enabling enumeration of contributor identity and project structure in otherwise-private deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Weblate installation has at least one private project (access_control set to private) or at least one restricted component configured - installations where all projects are public have no permission boundary to bypass. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 5.3 medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with the actual exposure: the attack is network-accessible with no authentication or user interaction required, but the confidentiality impact is bounded to metadata and no integrity or availability impact exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker targeting an internet-facing Weblate instance constructs RSS feed URLs for language or project feeds using the predictable slug-based URL structure. Submitting standard HTTP GET requests to these endpoints returns an XML feed populated with change history from private projects, including contributor full names, usernames, component identifiers, and action timestamps that the attacker has no authorization to view. … |
| Remediation | Upgrade to Weblate 2026.8 or later; this version applies per-user permission filtering to all object-scoped RSS feed queries and is confirmed as the fix by vendor changelog and commit 9bcccfd3a38eea6ebffce582222cd5eac3aa3642 (https://github.com/WeblateOrg/weblate/commit/9bcccfd3a38eea6ebffce582222cd5eac3aa3642). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS,
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Weblate is a web based localization tool. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Pub
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today