Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

보통 4.3CVE-2025-67715 · GHSA-3pmh-24wp-xpf4 · PYSEC-2025-233 · Published 16/12/2025 · updated 07/10/2026

요약

CVE-2025-67715은(는) weblate, weblate (weblate)에 영향을 주는 보통 (CVSS 4.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.27%, 전체 취약점의 19.6%보다 높음.
조치: 5.15 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
weblate PyPI	`< 5.15`	`5.15`
weblate weblate	`< 5.15`	`5.15`

Description

Impact

It was possible to retrieve user notification settings or list all users via API.

Patches

https://github.com/WeblateOrg/weblate/pull/17256

References

Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to Weblate.

NVD description

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

References

WeblateOrg/weblate security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-67715 · ADVISORY
WeblateOrg/weblate#17256 · WEB
WeblateOrg/weblate · PACKAGE
pypa/advisory-database · WEB

weblate의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

weblate

PyPI

< 5.15

5.15

weblate

< 5.15

5.15

Description

Impact

It was possible to retrieve user notification settings or list all users via API.

Patches

https://github.com/WeblateOrg/weblate/pull/17256

References

Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to Weblate.

NVD description

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

weblate의 다른 취약점

모두 보기 →