CVE-2026-55228: Weblate IDOR Vulnerability Allows Unauthorized Access to Private Projects
Summary
CVE-2026-55228: Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. Affects weblate versions < 2026.7. Fixed in 2026.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation management system that facilitates collaborative translation of software and documents. It provides features such as translation memory, glossary management, and integration with version control systems. However, a recent vulnerability has been identified that affects the security of project access for users with specific roles.
Vulnerability Detail
The vulnerability arises from an Insecure Direct Object Reference (IDOR) in the GroupViewSet of Weblate. This flaw allows authenticated project managers to gain unauthorized read access to private projects, potentially exposing sensitive information. The API fails to properly handle project- and workspace-scoped teams, enabling users to set invalid configurations that grant access to projects they should not be able to view. This could lead to significant data breaches and unauthorized information disclosure.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.7
This is the first release that contains the fix.
pip install --upgrade "weblate==2026.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to project management features for users who do not require it. Review user permissions and ensure that only authorized personnel have access to sensitive projects until the patch is applied.
Conclusion
The IDOR vulnerability in Weblate (CVE-2026-55228) poses a significant risk by allowing unauthorized access to private projects. It is crucial for users to update to the patched version and review their user permissions to mitigate potential risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for weblate →
FAQ
CVE-2026-55228 is a vulnerability in Weblate that allows authenticated project managers to access private projects without proper authorization.
If you are using an affected version of Weblate, unauthorized users may gain access to sensitive project data, leading to potential data breaches.
Update to version 2026.7 or later to patch the vulnerability. Additionally, review user permissions to limit access to sensitive projects.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
