PT-2026-33114 · Weblate · Weblate

CVE-2026-33214 · Published 2026-04-15 · Updated 2026-04-16

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17

Description The translation memory API exposed unintended endpoints that failed to enforce proper access control.

Recommendations Update to version 5.17. As a temporary workaround, block access to the endpoint '/api/memory/' in the HTTP server to remove access to this feature.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-33214

GHSA-MPF5-3VPH-Q75R

PYSEC-2026-152

Affected Products

Weblate

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33214.json · Exploit
• https://github.com/WeblateOrg/weblate/pull/18513 · Patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mpf5-3vph-q75r · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-152 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33214 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33214 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mpf5-3vph-q75r · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-152.yaml · Note
• https://twitter.com/CVEnew/status/2044737944871727285 · Twitter Post