Weblate wlc EUVD-2026-84823

Exploitation requires ALL of: (1) the victim runs wlc inside an untrusted repository, pull-request checkout, or a directory with an untrusted ancestor .weblate/.weblate.ini/weblate.ini that defines an API url; (2) the victim supplies an UNSCOPED API token via the WLC_KEY environment variable or the --key flag; and (3) the victim does NOT pin the destination via WLC_URL or --url. Exploitation is LIMITED by these preconditions plus required user interaction (the victim must invoke wlc) and local execution context. It does NOT apply when URL-scoped keys in the [keys] config section are used, nor when the URL is explicitly pinned. Versions 2.0.1 and later reject unscoped keys when the API URL comes from auto-discovered project configuration.

This is a low-priority issue whose signals are internally consistent and point away from urgent action. The vendor CVSS of 2.3 (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N) correctly captures a local, high-complexity, interaction-dependent token-leak with no integrity or availability impact. No EPSS score, KEV listing, or public exploit was provided, so exploitation status is: no public exploit identified at time of analysis. The one metric I would contest is PR:H - the attacker needs no privileges on the victim's system; they only plant a malicious project config in a repository the victim later checks out, so PR:N with the difficulty captured in AC:H/UI:R is more accurate (see assessed vector). The scope change (S:C) and confidentiality-only impact are appropriate because the leaked API token belongs to a different security authority (the Weblate server). Realistic risk is limited by the tight preconditions: the victim must use an unscoped WLC_KEY/--key without pinning WLC_URL/--url, AND run wlc inside an untrusted repository/PR checkout/directory carrying attacker-controlled ancestor configuration. This is a targeted CI/supply-chain-style credential-leak, not a broadly exploitable flaw.

An attacker submits a pull request (or publishes a repo) containing a malicious .weblate/.weblate.ini/weblate.ini that sets the API url to an attacker-controlled server. A CI job or developer then runs wlc in that checkout with an unscoped token injected via WLC_KEY/--key but without pinning WLC_URL/--url, and wlc transmits the token to the attacker's URL. No public exploit code is identified, and exploitation is high-complexity and requires the victim to run the client (UI:R).