CVE-2017-5537: Password Reset Form Enumeration in Weblate
Summary
CVE-2017-5537: The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a seri... Affects weblate across 2 version ranges.
< 2.10.1
< abe0d2a29a1d8e896bfe829c8461bf8b391f1079
Fixed in abe0d2a29a1d8e896bfe829c8461bf8b391f1079. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation management system. It provides a platform for collaborative translation of software, documentation, and other types of content. Weblate allows users to manage translation projects, invite contributors, and track progress. It is widely used by organizations and communities to streamline the localization process.
Vulnerability Detail
The password reset form in Weblate before version 2.10.1 is vulnerable to an enumeration attack. When a user submits an email address for password reset, the application provides different error messages depending on whether the email address is associated with an account. This behavior allows remote attackers to enumerate user accounts by sending a series of requests and observing the error messages. By exploiting this vulnerability, an attacker can gather a list of valid email addresses associated with Weblate user accounts, potentially facilitating further attacks such as phishing or brute-forcing.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
abe0d2a29a1d8e896bfe829c8461bf8b391f1079
This is the first release that contains the fix.
pip install --upgrade "weblate==abe0d2a29a1d8e896bfe829c8461bf8b391f1079"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading Weblate to the patched version.
Conclusion
The password reset form enumeration vulnerability in Weblate before version 2.10.1 can lead to the disclosure of valid email addresses associated with user accounts. It is crucial for Weblate administrators to upgrade to the patched version to prevent potential attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for weblate →
FAQ
The vulnerability allows remote attackers to enumerate user accounts in Weblate by exploiting the password reset form. This information can be used for targeted attacks, such as phishing or brute-forcing.
You can use the Vulert Playground at Vulert Scanner to check if your Weblate installation is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
There are no publicly known instances of this vulnerability being exploited. However, it is crucial to apply the fix as soon as possible to prevent potential attacks.
No, the only way to mitigate the risk is by upgrading Weblate to version 2.10.1 or later. Applying the fix ensures that the password reset form no longer leaks information about the existence of user accounts.
You can find more information about this vulnerability, including the technical details and the fix, in the official advisory provided by the Weblate project. The advisory is available at https://github.com/pypa/advisory-database/blob/main/vulns/weblate/PYSEC-2017-42.yaml.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
