GitHub Advisoryadvisory · PyPI

GHSA-mpf5-3vph-q75r Weblate: Improper access control for the translation memory in API

MEDIUM Published 2026-04-16 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-33214
Ecosystem
PyPI
Packages
Weblate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2026-04-16

Affected packages

• PyPI Weblate: < 5.17 → fixed in 5.17

Description

Impact The translation memory API exposed unintended endpoints, which in turn didn't do proper access control. Patches • https://github.com/WeblateOrg/weblate/pull/18513 Workarounds Blocking access to `/api/memory/` in the HTTP server removes access to this feature. References This issue was reported by ggamno via HackerOne.

Related

Alias · CVE (1)

  • CVE-2026-33214 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References