EUVD-2026-66710Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Network API requires prior authentication (PR:L) and depends on an admin-triggered invitation flow (UI:R); impact is limited to unauthorized team membership (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.
AnalysisAI
Weblate's REST API prior to version 2026.8 permits authenticated users to silently replace their account's primary email with any unverified address via PUT or PATCH requests to /api/users/{username}/, bypassing the normal email-verification flow. This allows an attacker to pre-claim an email address and then accept team or project invitations directed to that address without ever accessing the intended recipient's mailbox. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid authenticated account on the target Weblate instance (PR:L confirmed by CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 3.5 (Low) accurately reflects the constrained impact: the vulnerability is network-accessible with low complexity, but requires prior authentication (PR:L) and depends on an administrator subsequently dispatching an invitation to the claimed address (UI:R), with only a low integrity impact and no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Weblate user sends a PATCH request to /api/users/{username}/ with a target email address - one they do not own and have not verified - setting it as their primary account email. When an administrator later issues a team invitation to that same address, the attacker's account automatically becomes the recipient and accepts membership in the project or group, granting unauthorized access without the legitimate address owner ever being involved. … |
| Remediation | The primary and recommended remediation is to upgrade Weblate to version 2026.8 or later, which enforces that email addresses submitted to the REST API must already be present in the user's set of verified addresses. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today