CVE-2026-55227
Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
- Record
CVE-2026-55227- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
EUVDEUVD-2026-66712
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
- Record
EUVD-2026-66712- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2p9g-x3cv-5hh4
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
Impact
The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404.
Patches
References
Thanks to Yaohui Wang for reporting this via GitHub.
- Record
GHSA-2p9g-x3cv-5hh4- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
NVD
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
- Record
CVE-2026-55227- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSV
Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
- Record
CVE-2026-55227- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSVGHSA-2p9g-x3cv-5hh4
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
Impact
The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404.
Patches
References
Thanks to Yaohui Wang for reporting this via GitHub.
- Record
GHSA-2p9g-x3cv-5hh4- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSVPYSEC-2026-3941
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
Impact
The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404.
Patches
References
Thanks to Yaohui Wang for reporting this via GitHub.
- Record
PYSEC-2026-3941- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
weblatePyPI |
before 2026.7 | 2026.7 |
weblatePyPI |
before 2026.7, plus listed versions 1.92.02.12.102.10.1 Show 45 moreShow less2.112.122.132.13.12.142.14.12.152.162.172.17.12.182.192.19.12.22.202.32.42.52.62.72.82.92026.52026.62026.6.13.03.0.13.13.1.13.103.10.13.10.23.10.33.113.11.13.11.23.11.33.23.2.13.2.23.33.43.53.5.13.6 |
2026.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-55227 is a medium vulnerability (CVSS 4.3) in Weblateorg Weblate, published August 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in weblate 2026.7.
References
github.com/WeblateOrg/weblate/security/advisories/GHSA-2p9g-x3cv-5hh4
nvd.nist.gov/vuln/detail/CVE-2026-55227
pypi.org/project/weblate
Left out here: 118 versions. The JSON record has them.