CyberRota Analysis
AI-GeneratedAuthenticated users of Weblate prior to version 2026.8 can change an account's primary email address without verification, potentially allowing unauthorized access to team invitations sent to that address. This vulnerability poses a risk of account takeover and should be prioritized by organizations using Weblate for localization, especially those managing sensitive projects or data. Users are advised to upgrade to version 2026.8 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.