CVE-2026-61790 in Weblate
Summary
by MITRE • 08/27/2026
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global permissions. As a result, a user who belongs to a team that enforces 2FA and grants a global permission still receives that global permission even without 2FA configured, while the same requirement is correctly applied to project-, component-, and workspace-scoped permissions. Such a user can act on the granted global permission, including reaching the site management interface at /manage/. This issue is fixed in version 2026.7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
Weblate serves as a critical web-based continuous localization platform designed to manage software translations for development teams and organizations. In versions prior to 2026.7, the application implements role-based access control mechanisms that distinguish between team-scoped permissions and site-wide global permissions. A significant architectural flaw exists in how these two permission scopes interact with multi-factor authentication policies. Specifically, while the system correctly enforces a requirement for users to configure two-factor authentication before receiving project-, component-, or workspace-scoped permissions within teams, this security control is not applied when granting site-wide global permissions. This inconsistency creates a bypass mechanism where the enforcement of identity verification protocols is context-dependent rather than universal across all administrative actions.
The technical flaw stems from an incomplete implementation of access validation logic during the permission assignment process for global roles. When a user belongs to a team that mandates two-factor authentication, the system verifies this requirement before granting permissions limited to specific projects or workspaces. However, when the same action involves assigning a global permission, such as site administrator rights, the application fails to check whether the user has completed the mandatory two-step verification process. Consequently, an authenticated user can acquire elevated privileges that allow them to access sensitive administrative interfaces, including the site management interface located at /manage/, without having secured their account with additional authentication factors. This represents a failure in consistent policy enforcement across different privilege levels within the application's authorization framework.
The operational impact of this vulnerability is substantial for organizations relying on Weblate for managing translation workflows and maintaining strict security postures. An attacker or malicious insider who obtains valid credentials could exploit this gap to escalate privileges without triggering additional authentication challenges. By acquiring global permissions, such an actor gains unrestricted access to site-wide settings, potentially allowing them to modify system configurations, manage user accounts across all projects, or alter localization pipelines that affect the entire organization's software release process. This undermines the principle of least privilege and compromises the integrity of the security controls intended to protect sensitive administrative functions from unauthorized access.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting issues where authorization checks are inconsistently applied based on the scope or type of permission being granted. It also relates to CWE-306 Missing Authentication for Critical Function, as the critical function of accessing site management interfaces is performed without verifying that mandatory authentication steps have been completed. In terms of adversary behavior, this flaw facilitates privilege escalation and could be leveraged in conjunction with credential theft attacks found under MITRE ATT&CK techniques such as T1078 Valid Accounts or T1098 Exploitation for Privilege Escalation, allowing an actor to move laterally within the administrative layer of the platform.
To mitigate this risk, organizations using Weblate must immediately upgrade to version 2026.7 or any subsequent release where the logic has been corrected to enforce two-factor authentication requirements uniformly across all permission scopes, including global ones. Until the update is applied, administrators should manually audit user accounts that hold global permissions and ensure those individuals have enabled multi-factor authentication through alternative administrative controls if available. Additionally, implementing strict monitoring of access patterns to the /manage/ interface can help detect unauthorized privilege escalation attempts resulting from this vulnerability. Regular security assessments focusing on role-based access control consistency are recommended to identify similar gaps in other enterprise applications where permission scopes may vary in their enforcement of identity verification policies.