CVE-2026-77507

Received Received - Intake

Weblate Object-Scoped RSS Feed Permission Bypass

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations that permit anonymous access, this metadata can be retrieved without any authentication. The exposed information can include project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, though translated-string content is not included in the feed. Installations using private projects or restricted components are affected. This issue is fixed in version 2026.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-77507

Affected Vendors & Products

Vendor	Product	Version / Range
weblate	weblate	to 2026.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Weblate before version 2026.8 has a flaw in its object-scoped RSS feeds where permission checks are not applied. This allows unauthorized users to access change-history metadata from private projects or restricted components. Anonymous users can retrieve this data without authentication if the system permits it. The exposed data includes project names, contributor details, timestamps, and action types but excludes translation content.

Detection Guidance

Check Weblate version with command: weblate --version. If version is prior to 2026.8, the system is vulnerable. Inspect RSS feed URLs for private projects or restricted components to see if metadata is exposed without authentication.

Impact Analysis

If you use Weblate with private projects or restricted components, sensitive metadata about your localization workflow could be exposed. This includes information about contributors, project structure, and activity timelines, which might aid attackers in reconnaissance or social engineering. Anonymous access settings amplify the risk.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal data such as contributor names and project details without authorization. Metadata leaks may violate data protection requirements for confidentiality and access controls.

Mitigation Strategies

Upgrade Weblate to version 2026.8 or later immediately. If anonymous access is enabled, disable it. Review and restrict access to RSS feeds for private projects and components.

Hi! I’m here to help you understand CVE-2026-77507. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70