CVE-2025-64725: Weblate has improper validation upon invitation acceptance

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-15 · updated 2026-10-07
Weakness: CWE-286

Description

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended.

Affected products

WeblateOrg weblate: before 5.15 — fixed in 5.15

How to fix

Upgrade to a fixed version: WeblateOrg weblate 5.15. Check the vendor advisory for mitigations.

References

https://github.com/WeblateOrg/weblate/commit/02e904675f0608a6bbfbf9466eeccd9d022591e9
https://github.com/WeblateOrg/weblate/pull/16913
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-m6hq-f4w9-qrjj

Get alerted when CVE-2025-64725 or the next vulnerability affects your stack