CVE-2026-55227: Weblate Package Exposes Object Existence Information via 403 Status Codes
Summary
CVE-2026-55227: Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404. Affects weblate versions < 2026.7. Fixed in 2026.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation tool that facilitates collaborative translation of software and other content. It allows users to manage translation projects, track changes, and integrate with various version control systems. However, a vulnerability has been identified that could lead to unauthorized disclosure of object existence information to users who should not have access to it.
Vulnerability Detail
The vulnerability arises from several endpoints in Weblate that return an HTTP status code of 403 (Forbidden) instead of the expected 404 (Not Found) when users attempt to access objects they do not have permission to view. This behavior can inadvertently leak information about the existence of certain objects, potentially allowing unauthorized users to infer the presence of sensitive data.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.7
This is the first release that contains the fix.
pip install --upgrade "weblate==2026.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional access controls or modify your application logic to handle forbidden requests more securely, ensuring that sensitive object existence is not disclosed.
Conclusion
In summary, CVE-2026-55227 is a moderate severity vulnerability in the Weblate package that can lead to unauthorized disclosure of object existence information. Users are advised to update to version 2026.7 or later to mitigate this issue. For those unable to update immediately, implementing additional access controls is recommended.
See every vulnerability recorded for weblate →
FAQ
CVE-2026-55227 is a vulnerability in the Weblate package that allows unauthorized users to infer the existence of objects through misleading HTTP status codes.
If your application uses Weblate and is affected by this vulnerability, unauthorized users may gain insights into the existence of sensitive objects, which could lead to further security issues.
If an immediate update is not possible, consider implementing additional access controls or modifying your application logic to prevent unauthorized users from accessing sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
