PT-2026-33113 · Weblate · Weblate

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-33212

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17

Description The tasks API does not verify user access for pending tasks, which could expose logs of in-progress operations to users without the required scope access. Exploitation requires brute-forcing the random UUID of the task, making it unlikely with default API rate limits.

Recommendations Update to version 5.17.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-33212

GHSA-VJ45-X3PJ-F4W4

Affected Products

Weblate

References · 7

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vj45-x3pj-f4w4 · Vendor Advisory
• https://github.com/WeblateOrg/weblate/commit/4e06b12cd05d087db68384e09d5f70fe883f2b70 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33212 · Security Note
• https://osv.dev/vulnerability/GHSA-vj45-x3pj-f4w4 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/pull/18515 · Note
• https://twitter.com/CVEnew/status/2044737945869894138 · Twitter Post