CVE-2026-55227: Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weblateto a version that resolves this vulnerability.Fixed in 2026.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any Weblate user with low-level authenticated access can exploit it remotely. The attacker does not need to interact with another user, but needs identifiers or guesses for objects in private projects.
What information can an attacker obtain?
An attacker can distinguish existing objects in private projects from nonexistent objects by comparing HTTP 403 and 404 responses. The disclosed information is object existence; the described issue does not provide access to the private object itself.
Are installations affected by default?
The issue affects Weblate versions before 2026.7 where private projects contain objects that an authenticated user is not authorized to access. Public-only deployments would not have private-project object existence to disclose.
What should be done if an immediate upgrade is not possible?
The provided data identifies version 2026.7 as the fix. Until upgrading, limit access to authenticated Weblate accounts and treat object identifiers in private projects as potentially discoverable by unauthorized users.