GitHub Advisoryadvisory · PyPI

GHSA-m6hq-f4w9-qrjj Weblate has improper validation upon invitation acceptance

LOW Published 2025-12-15 Modified 2025-12-17 Official page ↗
Aliases
CVE-2025-64725
Ecosystem
PyPI
Packages
Weblate
Severity
Low
CVSS vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-286
Reviewed
2025-12-15

Affected packages

• PyPI Weblate: < 5.15 → fixed in 5.15

Description

Impact It was possible to accept an invitation opened by a different Weblate user. Patches • https://github.com/WeblateOrg/weblate/pull/16913 Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. References Thanks to Nahid0x for responsibly disclosing this vulnerability to Weblate.

Related

Alias · CVE (1)

  • CVE-2025-64725 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-286 Incorrect User Management weakness

References