Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

中危 4.3CVE-2025-67715 · GHSA-3pmh-24wp-xpf4 · PYSEC-2025-233 · Published 16/12/2025 · updated 07/10/2026

要点

CVE-2025-67715 是影响 weblate, weblate (weblate) 的中危 (CVSS 4.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.27%，高于 19.6% 的漏洞。
修复：升级到 5.15 或更高版本。

Package	Affected versions	Patched versions
weblate PyPI	`< 5.15`	`5.15`
weblate weblate	`< 5.15`	`5.15`

Description

Impact

It was possible to retrieve user notification settings or list all users via API.

Patches

https://github.com/WeblateOrg/weblate/pull/17256

References

Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to Weblate.

NVD description

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

References

WeblateOrg/weblate security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-67715 · ADVISORY
WeblateOrg/weblate#17256 · WEB
WeblateOrg/weblate · PACKAGE
pypa/advisory-database · WEB

weblate 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

weblate

PyPI

< 5.15

5.15

weblate

< 5.15

5.15

Description

Impact

It was possible to retrieve user notification settings or list all users via API.

Patches

https://github.com/WeblateOrg/weblate/pull/17256

References

Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to Weblate.

NVD description

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

weblate 的其他漏洞

查看全部 →