EUVD-2026-66713Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-exposed REST API exploitable by any authenticated user (PR:L); no special conditions; high confidentiality and integrity impact from unauthorized project access; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.
AnalysisAI
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allowing any authenticated low-privilege user to assign unauthorized projects or workspaces to a team via the API. The root serializer field defining_workspace resolved primary keys against Workspace.objects.all() without filtering by the requesting user's permissions, enabling horizontal privilege escalation to private projects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Weblate user account with an API token - any authenticated user regardless of their assigned roles qualifies (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the threat profile: network-reachable, low-complexity, low-privilege exploitation yielding high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Weblate user with a low-privilege API token crafts a POST request to the team creation or update endpoint, supplying the primary key integer of a private project or workspace they do not normally have access to in the `defining_workspace` or `defining_project` field. The pre-patch API resolves this key against the full workspace table without permission checks and silently grants the attacker's team access to the target project, exposing private translation content and allowing repository and project-management operations. … |
| Remediation | The primary fix is to upgrade Weblate to version 2026.7 or later, which enforces proper queryset-level permission filtering on team workspace and project assignments in the REST API. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Weblate instances in your environment and verify their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS,
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Weblate is a web based localization tool. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Pub
Server-Side Request Forgery in Weblate's VCS_RESTRICT_PRIVATE control (versions 5.15 through pre-2026.6) allows bypassin
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today