PT-2026-2289 · Weblate+2 · Wlc+2

Zee99Y · Published 2026-01-12 · Updated 2026-01-27 · CVE-2026-22251

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wlc versions prior to 1.17.0

Description wlc, a Weblate command-line client utilizing Weblate’s REST API, permitted the use of unscoped API keys in its settings before version 1.17.0. Although discouraged, the functionality was not removed, potentially leading to API key leakage to various servers.

Recommendations Update to version 1.17.0 or later.

Exploit

Fix

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-922

Related Identifiers

CVE-2026-22251

GHSA-9RP8-H4G8-8766

USN-7981-1

Affected Products

Linuxmint

Ubuntu

Wlc

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22251.json · Exploit
• https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766 · Vendor Advisory
• https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22251 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7981-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22251 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22251 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22251 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9rp8-h4g8-8766 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22251 · Security Note
• https://ubuntu.com/security/notices/USN-7981-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22250 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22251 · Security Note
• https://github.com/WeblateOrg/wlc · Note