CVE-2026-62364

Received Received - Intake

wlc CLI Unscoped Token Exposure in Configuration

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-62364

EUVD

EUVD-2026-84823

Affected Vendors & Products

Vendor	Product	Version / Range
weblate	wlc	to 2.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-349	The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The vulnerability in wlc (a Weblate command-line client) before version 2.0.1 allows an attacker to trick the application into sending an API token to a malicious URL. This happens when wlc automatically loads configuration from files like .weblate or weblate.ini in an untrusted directory or repository, which can override the intended API URL while using a token from environment variables or command-line arguments.

Detection Guidance

Check for wlc versions prior to 2.0.1 by running 'wlc --version'. Inspect repositories for .weblate, .weblate.ini, or weblate.ini files that may contain unscoped API tokens. Verify if tokens are exposed in environment variables like WLC_KEY without corresponding WLC_URL.

Impact Analysis

If you use wlc in an untrusted environment (like a pull request checkout or a directory with untrusted files), an attacker could steal your API token. This token could grant access to your Weblate projects, allowing unauthorized changes or data exposure.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves token exposure in untrusted repositories rather than data breaches or unauthorized access to regulated data. However, if the exposed token grants access to translation data containing personal or health information, it could indirectly lead to compliance violations depending on data handling practices.

Mitigation Strategies

Upgrade wlc to version 2.0.1 or later. Ensure API tokens are scoped to specific URLs by using [keys] sections in configuration files. Remove any unscoped tokens from WLC_KEY or --key and replace them with URL-scoped tokens.

Hi! I’m here to help you understand CVE-2026-62364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70