Weblate: Privilege escalation in the user API endpoint

高危 8.8CVE-2026-34393 · GHSA-3382-gw9x-477v · PYSEC-2026-155 · Published 15/04/2026 · updated 26/10/2026

要点

CVE-2026-34393 是影响 weblate, weblate (weblate) 的高危 (CVSS 8.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.39%，高于 33.2% 的漏洞。
修复：升级到 5.17 或更高版本。

Package	Affected versions	Patched versions
weblate PyPI	`< 5.17`	`5.17`
weblate weblate	`< 5.17`	`5.17`

Description

Impact

The user patching API endpoint didn't properly limit the scope of edits.

Patches

https://github.com/WeblateOrg/weblate/pull/18687

References

Thanks to @tikket1 and @DavidCarliez for reporting this via GitHub. We received two individual reports for this.

NVD description

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

References

WeblateOrg/weblate security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-34393 · ADVISORY
WeblateOrg/weblate#18687 · WEB
WeblateOrg/weblate · PACKAGE
pypa/advisory-database · WEB

weblate 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

weblate

PyPI

< 5.17

5.17

weblate

< 5.17

5.17

Description

Impact

The user patching API endpoint didn't properly limit the scope of edits.

Patches

https://github.com/WeblateOrg/weblate/pull/18687

References

Thanks to @tikket1 and @DavidCarliez for reporting this via GitHub. We received two individual reports for this.

NVD description

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

weblate 的其他漏洞

查看全部 →