What’s Vulnerable › Vulnerabilities

CVE-2026-55227: Observable object existence disclosure in private Weblate projects via globally scoped object lookups

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-09-09
• Weakness: CWE-203

Description

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.

Affected products

• WeblateOrg weblate: before 2026.7

References

• https://github.com/WeblateOrg/weblate/commit/836bc082803d49d02f2831ec8339268eb66bcdae
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2p9g-x3cv-5hh4

Get alerted when CVE-2026-55227 or the next vulnerability affects your stack