CVE-2025-67492: Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
Impact
It was possible to trigger repository updates for many repositories via a crafted webhook payload.
Patches
https://github.com/WeblateOrg/weblate/pull/17221
Workarounds
Disabling webhooks completely using ENABLEHOOKS avoids this vulnerability.
References
Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.
Other sources
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using ENABLEHOOKS avoids this vulnerability.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67492?
CVE-2025-67492 has a moderate severity due to its potential to trigger unauthorized repository updates.
How do I fix CVE-2025-67492?
To fix CVE-2025-67492, you should update Weblate to version 5.15 or later.
What are the workarounds for CVE-2025-67492?
A temporary workaround for CVE-2025-67492 is to disable webhooks completely by setting ENABLE_HOOKS to false.
Which versions of Weblate are affected by CVE-2025-67492?
CVE-2025-67492 affects all versions of Weblate prior to 5.15.
What does CVE-2025-67492 impact in Weblate?
CVE-2025-67492 allows attackers to trigger repository updates via crafted webhook payloads.