CVE-2025-64725: Weblate Improper Invitation Acceptance Vulnerability
Summary
CVE-2025-64725: Weblate has improper validation upon invitation acceptance. Affects weblate versions < 5.15. Fixed in 5.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is a web-based translation management system that facilitates collaborative translation of software and documents. It allows users to manage translation projects, track changes, and collaborate effectively. However, it has been identified that Weblate has a vulnerability related to improper validation during the invitation acceptance process, which could potentially allow unauthorized users to accept invitations intended for others.
Vulnerability Detail
The vulnerability arises from a flaw in the invitation acceptance mechanism within Weblate. Specifically, it allows a user to accept an invitation that was meant for a different user. This could lead to unauthorized access to translation projects and sensitive data, compromising the integrity and confidentiality of the project. The issue is classified under CWE-286, which pertains to improper authentication.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.15
This is the first release that contains the fix.
pip install --upgrade "weblate==5.15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid leaving Weblate sessions unattended when an invitation is open. This can help mitigate the risk of unauthorized invitation acceptance.
Conclusion
In summary, CVE-2025-64725 is a significant vulnerability in Weblate that allows improper acceptance of invitations, potentially leading to unauthorized access. Users are encouraged to update to the latest version to mitigate this risk and implement the suggested workarounds until they can do so.
See every vulnerability recorded for weblate →
FAQ
CVE-2025-64725 is a vulnerability in Weblate that allows users to improperly accept invitations meant for other users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main risk is unauthorized access to translation projects, which could lead to data breaches and compromise project integrity.
Yes, a patch is available in Weblate version 5.15 and later. Users should update to this version to fix the vulnerability.
If you cannot update immediately, ensure that you do not leave Weblate sessions unattended with open invitations to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
