CVE-2026-44263: Weblate: Private Translation Enumeration via Screenshot API
Impact
The screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user.
Patches https://github.com/WeblateOrg/weblate/pull/19258
Acknowledgement Weblate thanks Luay for reporting this vulnerability according to the organization's security issues guideline.
Other sources
Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44263?
CVE-2026-44263 has a medium severity rating due to its potential to allow unauthorized enumeration of translations.
How do I fix CVE-2026-44263?
To mitigate CVE-2026-44263, upgrade to Weblate version 5.17.1 or later.
What are the potential impacts of CVE-2026-44263?
CVE-2026-44263 can lead to unauthorized access to translations in a project that a user should not see.
Which versions of Weblate are affected by CVE-2026-44263?
Weblate versions prior to 5.17.1 are affected by CVE-2026-44263.
What components are involved in CVE-2026-44263?
CVE-2026-44263 involves the screenshots, tasks, and component link API in Weblate.