PT-2025-45379 · Weblate · Weblate

CVE-2025-64326 · Published 2025-11-05 · Updated 2025-11-12

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.14.1

Description Weblate versions 5.14 and below disclose the IP address of a project member when inviting a user to a project. The audit log, which includes IP addresses from administrative actions, is accessible to invited users, leading to potential information leakage.

Recommendations Update to version 5.14.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-212

Related Identifiers

CVE-2025-64326

GHSA-GR35-VPX2-QXHC

OPENSUSE-SU-2025:15733-1

PYSEC-2025-126

PYSEC-2025-230

Affected Products

Weblate

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64326.json · Exploit
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gr35-vpx2-qxhc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64326 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-126 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gr35-vpx2-qxhc · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15733-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64326 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-230 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/pull/16781 · Note
• https://github.com/WeblateOrg/weblate/commit/b847e9756a0a6f7659ef20fa9f34846ca862c574 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2025-230.yaml · Note
• https://twitter.com/VulmonFeeds/status/1986621315097243689 · Twitter Post
• https://suse.com/security/cve/CVE-2025-64326 · Note
• https://reddit.com/r/VulnMatter/comments/1oq8naq/resumen_diario_de_vulnerabilidades_06112025 · Reddit Post