CVE-2026-27457: Weblate Exposes Addon Configurations Due to Missing Access Control
Summary
CVE-2026-27457: Weblate: Missing access control for the AddonViewSet API exposes all addon configurations. Affects weblate versions < 5.16.1. Fixed in 5.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation tool that facilitates collaborative translation projects. It allows users to manage translation files and provides a user-friendly interface for translators. However, a recent vulnerability has been identified that compromises the security of addon configurations, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from a lack of proper access control in the AddonViewSet API of Weblate. This oversight allows unauthorized users to access and retrieve addon configuration data through the API. The implications of this vulnerability are significant, as it could lead to the exposure of sensitive configuration details that could be exploited by malicious actors. The vulnerability is categorized under CWE-200 (Information Exposure) and CWE-862 (Lack of Authorization).
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.16.1
This is the first release that contains the fix.
pip install --upgrade "weblate==5.16.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the API by implementing additional authentication checks or by limiting the API's exposure to trusted users only. However, the best course of action is to apply the patch as soon as possible.
Conclusion
In summary, CVE-2026-27457 represents a significant security risk for Weblate users due to inadequate access control in the AddonViewSet API. Users are strongly advised to update to version 5.16.1 or later to mitigate this vulnerability. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for weblate →
FAQ
CVE-2026-27457 is a vulnerability in Weblate that allows unauthorized access to addon configurations due to missing access control in the AddonViewSet API.
The risks include unauthorized access to sensitive addon configuration data, which could be exploited by attackers for malicious purposes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updating is not possible, consider implementing additional authentication checks or limiting API access to trusted users as a temporary workaround.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
