GitHub Advisoryadvisory · PyPI
GHSA-vj45-x3pj-f4w4 Weblate: Improper access control for pending tasks in API
LOW
Official page ↗
- Aliases
- CVE-2026-33212
- Ecosystem
- PyPI
- Packages
- weblate
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-284
- Reviewed
- 2026-04-16
Affected packages
• PyPI weblate: < 5.17 → fixed in 5.17
Description
Impact
The API for tasks didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope.
Patches
• https://github.com/WeblateOrg/weblate/pull/18515
Workarounds
The attacker needs to guess the random UUID of the task, so exploiting this is unlikely with the default API rate limits.
References
This issue was identified by Michal Čihař.
Related
Alias · CVE (1)
- CVE-2026-33212 Weblate is a web based localization tool. vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vj45-x3pj-f4w4 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-33212 advisory
- https://github.com/WeblateOrg/weblate/pull/18515 web
- https://github.com/WeblateOrg/weblate/commit/4e06b12cd05d087db68384e09d5f70fe883f2b70 web
- https://github.com/WeblateOrg/weblate package