CVE-2025-64725: Weblate Invitation Acceptance Vulnerability
Summary
CVE-2025-64725: Weblate has improper validation upon invitation acceptance. Affects weblate versions < 5.15. Fixed in 5.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is a web-based translation management system that facilitates collaborative translation of software and other content. It provides features such as version control, translation memory, and a user-friendly interface for translators. However, a vulnerability has been identified that allows improper validation during invitation acceptance, potentially compromising user accounts.
Vulnerability Detail
The vulnerability arises from improper validation when a user accepts an invitation to join a Weblate project. This flaw allows a user to accept an invitation that was intended for a different Weblate user, leading to unauthorized access to project resources. The impact of this vulnerability can include exposure of sensitive project data and unauthorized modifications by users who should not have access.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.15
This is the first release that contains the fix.
pip install --upgrade "weblate==5.15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users should avoid leaving Weblate sessions unattended when an invitation is open. This will help mitigate the risk of unauthorized invitation acceptance.
Conclusion
In summary, the CVE-2025-64725 vulnerability in Weblate allows improper validation of invitation acceptance, which can lead to unauthorized access. Users are advised to update to version 5.15 or later to mitigate this risk and to avoid leaving sessions unattended as a temporary workaround.
See every vulnerability recorded for weblate →
FAQ
The vulnerability allows users to accept invitations meant for other users, potentially leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that you do not leave your Weblate session unattended with an open invitation.
The vulnerability was responsibly disclosed by a security researcher known as Nahid0x.
The CVSS score of this vulnerability is 1.0, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
