CVE-2026-55227 in Weblate
Summary
by MITRE • 08/27/2026
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in versions of Weblate prior to release 2026.7 represents an information disclosure flaw rooted in inconsistent HTTP status code handling during object lookup operations. As a web-based localization management platform, Weblate relies heavily on granular access control mechanisms to ensure that sensitive translation data remains confined to authorized project teams. The core technical deficiency lies in the global scope of certain API endpoints and view functions within the application logic. Instead of performing an authorization check first or handling unauthorized access by returning a standard not found response for non-existent resources, these specific endpoints perform existence checks across all projects regardless of user permissions. When an authenticated but unauthorized user attempts to retrieve details about an object belonging to a private project they do not have permission to view, the system correctly denies access via HTTP 403 Forbidden rather than masking this denial behind an HTTP 404 Not Found response typically used for non-existent resources.
This distinction between status codes creates a subtle but exploitable side-channel that allows attackers to enumerate valid objects within private projects. In secure application design, particularly when dealing with sensitive data like proprietary translations or intellectual property, it is standard practice to return 404 errors for both non-existent items and items the user cannot access. By returning 403 Forbidden specifically for unauthorized attempts on existing objects, Weblate inadvertently leaks metadata about the existence of specific resources. An attacker can automate requests against known identifiers or guessable IDs associated with private projects. If a request results in a 403 status code, it confirms that the object exists and is protected by access controls. Conversely, if the response is 404, the object likely does not exist at all. This binary feedback loop enables precise enumeration of internal project structures without requiring direct read access to the content itself.
The operational impact of this vulnerability extends beyond simple existence confirmation. By mapping out which objects exist within private projects, an attacker can identify high-value targets such as critical translation files or configuration endpoints that might have secondary vulnerabilities. This reconnaissance phase is often a precursor to more severe attacks, including privilege escalation attempts or targeted exploitation of other flaws in the identified resources. The vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information and CWE-284: Improper Access Control, as it stems from insufficient enforcement of access control policies that fail to obscure resource existence from unauthorized actors. Furthermore, this behavior facilitates reconnaissance activities categorized under MITRE ATT&CK technique T1592: Gather Victim Host Information, specifically through enumeration of vulnerable or valuable assets within the application environment.
To mitigate this issue and prevent similar information leakage in future developments, it is essential that all endpoints enforcing access control consistently return HTTP 404 Not Found when a user attempts to access an object they are not authorized to view, regardless of whether the object actually exists in the database. This approach ensures that unauthorized users cannot distinguish between non-existent resources and protected ones, thereby neutralizing enumeration-based attacks. For organizations currently running vulnerable versions of Weblate, immediate upgrading to version 2026.7 or later is required as this release contains the necessary code changes to rectify the global scope lookup behavior. Additionally, security teams should review other API endpoints for similar patterns where status codes might inadvertently leak information about resource existence and implement consistent error handling strategies that prioritize obscurity of system internals over detailed diagnostic feedback in production environments.