CVE-2026-55228: Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.
Patches https://github.com/WeblateOrg/weblate/pull/19970
References
Parts of this issue were independently reported by four reporters: @H3xV0rT3x via GitHub imhego via HackerOne v01demort via HackerOne b4nder via HackerOne
Other sources
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Weblateto a version that resolves this vulnerability.Fixed in 2026.7 - Upgrade
Upgrade
Weblateto a version that resolves this vulnerability.Fixed in 2026.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with project-manager privileges can exploit it. The attack is performed through the REST API by submitting invalid project- or workspace-scoped team configurations.
Which deployments are affected?
Weblate versions prior to 2026.7 are affected. The provided information does not identify any configuration prerequisite beyond use of the affected REST API team configuration behavior.
What access could an attacker gain?
An attacker could assign projects to a team in a way that grants access to private projects outside their intended scope. This can permit unauthorized reading, translation, repository operations, and project-management actions.
What is the available remediation?
Upgrade Weblate to version 2026.7, which fixes the issue.