PT-2026-33113 · Weblate · Weblate

CVE-2026-33212 · Published 2026-04-15 · Updated 2026-04-16

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17

Description The tasks API does not verify user access for pending tasks, which could expose logs of in-progress operations to users without the required scope access. Exploitation requires brute-forcing the random UUID of the task, making it unlikely with default API rate limits.

Recommendations Update to version 5.17.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-33212

GHSA-VJ45-X3PJ-F4W4

PYSEC-2026-2311

Affected Products

Weblate

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33212.json · Exploit
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vj45-x3pj-f4w4 · Vendor Advisory
• https://github.com/WeblateOrg/weblate/commit/4e06b12cd05d087db68384e09d5f70fe883f2b70 · Patch
• https://osv.dev/vulnerability/CVE-2026-33212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33212 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2311 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vj45-x3pj-f4w4 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/pull/18515 · Note
• https://twitter.com/CVEnew/status/2044737945869894138 · Twitter Post