CVE-2026-62249

Received Received - Intake

Authenticated Change History Exposure in Weblate Prior to 2026.7

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. The nested endpoints do not apply the component-level access checks enforced on the direct component views, so the requester can enumerate changes for components that should be hidden from them. The exposed data can include the restricted component's identity, translation and unit links, and change payload fields such as source or translated string content in the target, old, and details values. This issue is fixed in version 2026.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-62249

Affected Vendors & Products

Vendor	Product	Version / Range
weblate	weblate	2026.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Weblate versions before 2026.7. An authenticated user with access to a project can view the change history of restricted components in that project through nested API endpoints. These endpoints bypass component-level access controls, allowing users to see hidden components' identities, translation details, and change payloads like source or translated strings.

Detection Guidance

To detect this vulnerability, check Weblate versions prior to 2026.7 by running: weblate --version. Monitor API access logs for unauthorized requests to nested change endpoints like /api/projects/{project}/changes/ or /api/components/{component}/changes/. Look for requests accessing components outside user permissions.

Impact Analysis

If you use Weblate versions prior to 2026.7, an attacker with authenticated access could access sensitive data from restricted components. This includes translation content and metadata that should be hidden, potentially leading to unauthorized information disclosure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR (data protection) or HIPAA (health information privacy) requirements. Exposure of restricted translation content or metadata could result in compliance breaches depending on the data involved.

Mitigation Strategies

Upgrade Weblate to version 2026.7 or later immediately. Review and restrict API access permissions for all users. Audit recent API logs for suspicious activity targeting nested change endpoints. Apply component-level access controls to all API endpoints.

Hi! I’m here to help you understand CVE-2026-62249. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70