CVE-2026-21889: Weblate leaks information via screenshots
Impact The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.
Patches https://github.com/WeblateOrg/weblate/pull/17516
References
Thanks to Lukas May and Michael Leu for reporting this.
Other sources
Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21889?
CVE-2026-21889 is classified as a medium severity vulnerability due to the risk of information leakage through unauthorized access to screenshots.
How do I fix CVE-2026-21889?
To fix CVE-2026-21889, update Weblate to version 5.15.2 or later where the access control issues have been addressed.
What type of data is vulnerable in CVE-2026-21889?
CVE-2026-21889 exposes screenshot images, which can be accessed by unauthenticated users if filenames are guessed.
Is CVE-2026-21889 specific to certain versions of Weblate?
Yes, CVE-2026-21889 affects Weblate versions up to and including 5.15.2.
Can unauthenticated users exploit CVE-2026-21889?
Yes, unauthenticated users can exploit CVE-2026-21889 by guessing the filenames of the exposed screenshots.