GitHub Advisoryadvisory · PyPI

GHSA-gcg5-86jr-f7jg Weblate Vulnerable to Private Translation Enumeration via Screenshot API

MEDIUM Published 2026-05-07 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-44263
Ecosystem
PyPI
Packages
weblate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-203
Reviewed
2026-05-07

Affected packages

• PyPI weblate: < 5.17.1 → fixed in 5.17.1

Description

Impact The screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. Patches • https://github.com/WeblateOrg/weblate/pull/19258 Acknowledgement Weblate thanks Luay for reporting this vulnerability according to the organization's security issues guideline.

Related

Alias · CVE (1)

  • CVE-2026-44263 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References