CVE-2026-33214: Weblate has improper access control for the translation memory API
Impact The translation memory API exposed unintended endpoints, which in turn didn't do proper access control.
Patches https://github.com/WeblateOrg/weblate/pull/18513
Workarounds Blocking access to /api/memory/ in the HTTP server removes access to this feature.
References This issue was reported by ggamno via HackerOne.
Other sources
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33214?
CVE-2026-33214 has been identified as a critical security vulnerability due to improper access control in the translation memory API.
How do I fix CVE-2026-33214?
To fix CVE-2026-33214, update Weblate to version 5.17 or later.
What versions of Weblate are affected by CVE-2026-33214?
CVE-2026-33214 affects all Weblate versions prior to 5.17.
What is the impact of CVE-2026-33214 on Weblate users?
The impact of CVE-2026-33214 allows unauthorized access to sensitive API endpoints, potentially exposing translation memory data.
Is there a workaround for CVE-2026-33214?
There is no known workaround for CVE-2026-33214; the only solution is to upgrade to version 5.17.