GitHub Advisoryadvisory · PyPI

GHSA-gr35-vpx2-qxhc Weblate leaks the IP of project member inviting user to be reviewer in Audit log

LOW Published 2025-11-05 Modified 2026-06-06 Official page ↗
Aliases
CVE-2025-64326
Ecosystem
PyPI
Packages
weblate
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-212
Reviewed
2025-11-05

Affected packages

• PyPI weblate: < 5.14.1 → fixed in 5.14.1

Description

Summary Weblate leaks the IP address of the project member inviting the user to the project in the audit log. Details The audit log included IP addresses from admin-triggered actions, and those could be viewed by invited users. Impact The inviting user's (admin's) IP address could be leaked to invited users.

Related

Alias · CVE (1)

  • CVE-2025-64326 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References