CVE-2026-27457: Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
Impact
Users were able to obtain add-on configuration via API.
Patches
https://github.com/WeblateOrg/weblate/pull/18107 https://github.com/WeblateOrg/weblate/pull/18164
References
Weblate thanks @lighthousekeeper1212 for responsible disclosure.
Other sources
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet (weblate/api/views.py, line 2831) uses queryset = Addon.objects.all() without overriding getqueryset() to scope results by user permissions. This allows any authenticated user (or anonymous users if REQUIRELOGIN is not set) to list and retrieve ALL addons across all projects and components via GET /api/addons/ and GET /api/addons/{id}/. Version 5.16.1 fixes the issue.
— NVD
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27457?
CVE-2026-27457 has a moderate severity level, allowing users to access add-on configuration via the API.
How do I fix CVE-2026-27457?
To fix CVE-2026-27457, update to Weblate version 5.16.1 or later.
What software is affected by CVE-2026-27457?
CVE-2026-27457 affects Weblate versions prior to 5.16.1.
Are there any patches available for CVE-2026-27457?
Yes, patches for CVE-2026-27457 are available and can be found in the related GitHub pull requests.
What can happen if CVE-2026-27457 is exploited?
If exploited, CVE-2026-27457 can lead to unauthorized access to add-on configurations through the API.