CVE-2026-55228: Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weblateto a version that resolves this vulnerability.Fixed in 2026.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with project-manager privileges can exploit it. The attack is performed through the REST API by submitting invalid project- or workspace-scoped team configurations.
Which deployments are affected?
Weblate versions prior to 2026.7 are affected. The provided information does not identify any configuration prerequisite beyond use of the affected REST API team configuration behavior.
What access could an attacker gain?
An attacker could assign projects to a team in a way that grants access to private projects outside their intended scope. This can permit unauthorized reading, translation, repository operations, and project-management actions.
What is the available remediation?
Upgrade Weblate to version 2026.7, which fixes the issue.