CVE-2026-33212: Weblate: Improper access control for pending tasks in API
Impact The API for tasks didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope.
Patches https://github.com/WeblateOrg/weblate/pull/18515
Workarounds The attacker needs to guess the random UUID of the task, so exploiting this is unlikely with the default API rate limits.
References This issue was identified by Michal Čihař.
Other sources
Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33212?
The severity of CVE-2026-33212 is classified as medium due to its impact on user access to pending task logs.
How do I fix CVE-2026-33212?
To fix CVE-2026-33212, update Weblate to version 5.17 or later which includes proper access controls for the tasks API.
What does CVE-2026-33212 exploit?
CVE-2026-33212 exploits improper access control in the Weblate tasks API, allowing unauthorized users to view pending task logs.
Which versions of Weblate are affected by CVE-2026-33212?
Weblate versions prior to 5.17 are affected by CVE-2026-33212.
Who is at risk from CVE-2026-33212?
Users of Weblate prior to version 5.17 are at risk from CVE-2026-33212, particularly if they have access to logs of in-progress operations.