EUVD-2026-22999
GHSA-mpf5-3vph-q75r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain low-privileged account
-
ExploitSend unauthorized HTTP request to /api/memory/ or /api/memory/{id}/ endpoint
-
ImpactModify translation memory data without proper authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated user account with low privileges (as indicated by CVSS PR:L). The attacker must have network access to the Weblate instance and the server must be running a version prior to 5.17 without the /api/memory/ workaround applied. The specific vulnerable feature is the unintended API endpoints that lacked access control; without these endpoints exposed, exploitation is not possible. |
| Impact | CVSS 3.1 score of 4.3 (Medium) with a network attack vector, low complexity, and low privileges required indicates that an authenticated attacker can easily exploit this flaw, but the impact is limited to low integrity (I:L) with no confidentiality or availability loss. The EPSS score of 0.01% and absence from CISA KEV confirm that exploitation is highly unlikely in the wild. SSVC assessment (exploitation: none, automatable: no, technical impact: partial) further supports that this is not an imminent threat. Overall, this is a low-priority vulnerability compared to truly critical access control issues, given the required authentication and minimal integrity impact. |
| Exploit ScenarioDerived | An attacker with a low-privileged account (e.g., a registered translator) sends crafted HTTP requests to the unintended /api/memory/ or /api/memory/{id}/ endpoints to modify translation memory entries, potentially injecting incorrect translations or disrupting localization workflows. No public proof-of-concept exploit code is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Low-privileged users can modify Weblate translation memory via improperly exposed API endpoints in versions prior to 5.17, leading to unauthorized data manipulation without affecting confidentiality or availability. The vulnerability is not known to be actively exploited and has a very low exploitation probability (EPSS 0.01%).
RemediationAI
Upgrade to Weblate 5.17 or later to apply the vendor patch. If immediate upgrade is not possible, block access to the /api/memory/ path in the HTTP server configuration as a workaround, but note that this disables the translation memory feature entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Weblate is a web-based localization tool that exposes a REST API for translation memory management. The vulnerability (CWE-862: Missing Authorization) arose because the API inadvertently exposed endpoints such as POST /api/memory/ and PUT /api/memory/{id}/, which lacked proper access control checks. The affected product, identified by CPE cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:*, allowed unauthorized modifications to shared translation memory data. The fix removed these unintended endpoints and redesigned the API surface as shown in the openapi.yaml changes in the referenced GitHub pull request.
Know when Weblate gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Requires low-privileged access to the API; no user interaction; limited to integrity impact on translation memory.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Improper input validation in Weblate versions prior to 5.15.1 lets a user who can submit translation files or restore pr
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Argument injection in Weblate's Mercurial backend lets an authenticated user with project-scoped component.edit permissi
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
Remote code execution in Weblate's project backup restoration affects versions prior to 5.17, exploitable by authenticat
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Exploit-DB