Weblate: Improper access control for the translation memory in API

TRUNG BÌNH 4.3CVE-2026-33214 · GHSA-mpf5-3vph-q75r · PYSEC-2026-152 · Công bố 15/04/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-33214 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng weblate, weblate (weblate).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.24%, cao hơn 14.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.17 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
weblate PyPI	`< 5.17`	`5.17`
weblate weblate	`< 5.17`	`5.17`

Mô tả

Impact

The translation memory API exposed unintended endpoints, which in turn didn't do proper access control.

Patches

https://github.com/WeblateOrg/weblate/pull/18513

Workarounds

Blocking access to /api/memory/ in the HTTP server removes access to this feature.

References

This issue was reported by ggamno via HackerOne.

Mô tả của NVD

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.