Weblate EUVD-2026-66720

Exploitation requires that the Weblate installation has at least one private project (access_control set to private) or at least one restricted component configured - installations where all projects are public have no permission boundary to bypass. On installations permitting anonymous access, exploitation requires no authentication whatsoever; on installations requiring login, any authenticated user can access feed metadata for projects and components beyond their permission scope. The RSS feed URLs follow a predictable pattern based on project and component slugs or language codes, making them discoverable through enumeration or by inspecting public-facing Weblate pages. Exploitation is strictly limited to change-history metadata: translated string content is not exposed. The primary limiting factor for unauthenticated exploitation is whether the Weblate instance allows anonymous access at all; instances requiring login for all access narrow the attack surface to authenticated-but-underprivileged users.

The NVD-assigned CVSS 5.3 medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with the actual exposure: the attack is network-accessible with no authentication or user interaction required, but the confidentiality impact is bounded to metadata and no integrity or availability impact exists. No EPSS score was included in the provided input data, so quantitative exploitation probability cannot be assessed. The vulnerability is not listed in CISA KEV, and no public exploit or proof-of-concept code was identified at time of analysis. Real-world priority is highly deployment-dependent: organizations using only public Weblate projects are entirely unaffected, while those managing proprietary, pre-release, or sensitive translation workflows in private projects face meaningful risk of contributor identity exposure and project structure enumeration. The attack requires knowing or guessing valid RSS feed URLs, which follow a predictable slug-based structure, lowering the practical bar. This is not a mass-exploitation candidate but represents a genuine reconnaissance and privacy risk for sensitive deployments.

An unauthenticated attacker targeting an internet-facing Weblate instance constructs RSS feed URLs for language or project feeds using the predictable slug-based URL structure. Submitting standard HTTP GET requests to these endpoints returns an XML feed populated with change history from private projects, including contributor full names, usernames, component identifiers, and action timestamps that the attacker has no authorization to view. No exploit code or specialized tooling is required - curl or a browser is sufficient.