CyberRota Analysis
AI-GeneratedWeblate versions prior to 2026.7 are vulnerable due to improper access control in several endpoints, allowing unauthorized users to determine the existence of objects in private projects by receiving HTTP 403 responses instead of 404. This could lead to information disclosure about project contents. Organizations using Weblate for localization should prioritize updating to version 2026.7 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.