CVE-2026-77508

Received Received - Intake

Authenticated Email Change in Weblate

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-77508

Affected Vendors & Products

Vendor	Product	Version / Range
weblate	weblate	2026.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-302	The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
CWE-841	The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

Executive Summary

This vulnerability in Weblate allows an authenticated user to change their account's primary email address without verifying the new email. This is done through PUT or PATCH requests to /api/users/{username}/ without confirmation. The issue is fixed in version 2026.8.

Detection Guidance

This vulnerability can be detected by checking Weblate instances for unauthorized email changes in user accounts. Review API logs for PUT or PATCH requests to /api/users/{username}/ that modify email addresses without verification. Ensure all email changes are validated through a confirmation process.

Impact Analysis

An attacker could change a user's email to one they control, then accept team invitations intended for the original user. This could lead to unauthorized access to team resources or data if the attacker gains control of the account.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized changes to user accounts, potentially violating data integrity and access control requirements in GDPR and HIPAA. Unauthorized access may lead to data breaches or improper handling of sensitive information.

Mitigation Strategies

Upgrade Weblate to version 2026.8 or later to address the vulnerability. Review user account email changes for unauthorized modifications and monitor team invitations to suspicious addresses.

Hi! I’m here to help you understand CVE-2026-77508. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70