CVE-2026-55227

Received Received - Intake

Information Disclosure in Weblate Prior to 2026.7

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-55227

Affected Vendors & Products

Vendor	Product	Version / Range
weblate	weblate	to 2026.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

Weblate versions before 2026.7 have endpoints that check object access globally instead of per project. This causes unauthorized users to receive a 403 Forbidden error instead of a 404 Not Found when accessing restricted objects. Attackers can exploit this to determine if specific objects exist in private projects.

Detection Guidance

This vulnerability can be detected by checking Weblate versions prior to 2026.7 and testing endpoints for improper access control. Compare your Weblate version against 2026.7. Test endpoints by attempting to access objects in private projects and verifying if HTTP 403 is returned instead of 404 for unauthorized access.

Impact Analysis

An attacker could use this flaw to confirm the existence of sensitive data in private Weblate projects. This may lead to information disclosure, helping attackers plan further exploits or gain unauthorized knowledge about project contents.

Compliance Impact

This vulnerability could violate data protection requirements by exposing the existence of private project data. GDPR and HIPAA mandate strict access controls and data confidentiality; unauthorized information disclosure risks non-compliance and potential penalties.

Mitigation Strategies

Upgrade Weblate to version 2026.7 or later to fix the issue. Monitor access logs for unauthorized attempts to access objects in private projects.

Hi! I’m here to help you understand CVE-2026-55227. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70