EUVD-2026-66717Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with valid Weblate project member credentials
-
DeliveryIdentify project containing a restricted component
-
ExploitIssue GET request to nested project or component change API endpoint
-
ExecutionReceive change records bypassing component-level access checks
-
ImpactExtract restricted component identity and string content from response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid Weblate user account with project membership (CVSS PR:L confirmed). The target deployment must have at least one component configured with the 'restricted' flag enabled - this is a non-default Weblate configuration used to hide specific components from general project members. The attacker calls one of three nested change API endpoints: the project change list ( |
| Impact | The vendor-assigned CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a limited, authenticated information-disclosure issue - no integrity or availability impact, and PR:L correctly reflects the requirement for project membership. No EPSS score was provided in the available intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at the time of analysis. The practical risk is highly deployment-dependent: organizations that do not use Weblate's restricted component feature are entirely unaffected regardless of version, while those that rely on it to segregate sensitive translation content from certain project members face a genuine access-control bypass. The exposed data - source and translated strings, component identity, and change payloads - could be sensitive in contexts such as unreleased product strings, confidential terminology, or security-relevant localization. |
| Exploit ScenarioDerived | An authenticated Weblate project member who has been explicitly excluded from a restricted component issues a GET request to the project-level change API endpoint ( |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Nested API change endpoints in Weblate prior to version 2026.7 bypass component-level access controls, exposing change history of restricted components to authenticated project members who lack direct view permissions. A low-privileged project member can call the project-, component-, or translation-level change list endpoints to enumerate change records for restricted components - including source and translated string content, component identity, and change metadata - that return 404 on direct component access. No public exploit or CISA KEV listing has been identified; real-world risk is conditional on use of Weblate's restricted component feature.
RemediationAI
Upgrade to Weblate 2026.7 or later, which resolves the issue by replacing unfiltered change querysets with permission-aware lookups across all three affected nested API endpoints. The fix is documented in the security advisory at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-92m8-wv36-prmx and implemented in commit a27b02110ab33995bce8cf9ea0eeddf72aa334ca. If immediate upgrade is not feasible, administrators can reduce exposure by removing project membership for any users who must not access restricted components, effectively revoking the PR:L prerequisite; the trade-off is loss of those users' access to all other project-level API functionality. Alternatively, restricting API access via network controls (firewall rules, reverse-proxy authentication) to only trusted clients limits the attack surface without breaking authenticated access for legitimate integrations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Weblate exposes a REST API with nested change-history endpoints at project, component, and translation granularity. The vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) originates from these three nested endpoints using a direct Django ORM queryset - obj.change_set.prefetch().order() - which fetches all related Change records without consulting Weblate's permission layer. The fix, introduced in commit a27b02110ab33995bce8cf9ea0eeddf72aa334ca, replaces all three querysets with the user-context-aware manager method Change.objects.last_changes(request.user, ...), which enforces component-level restricted access checks before returning results. Affected product is identified via CPE cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:*, covering all releases prior to 2026.7.
Know when Weblate gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L reflects required authenticated project membership; C:L because only change history metadata and string content are disclosed, not credentials or system data.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. The nested endpoints do not apply the component-level access checks enforced on the direct component views, so the requester can enumerate changes for components that should be hidden from them. The exposed data can include the restricted component's identity, translation and unit links, and change payload fields such as source or translated string content in the target, old, and details values. This issue is fixed in version 2026.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Improper input validation in Weblate versions prior to 5.15.1 lets a user who can submit translation files or restore pr
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Argument injection in Weblate's Mercurial backend lets an authenticated user with project-scoped component.edit permissi
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
Remote code execution in Weblate's project backup restoration affects versions prior to 5.17, exploitable by authenticat
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Exploit-DB