CVE-2026-61790: Weblate: Team-enforced 2FA is bypassed for global permissions
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global permissions. As a result, a user who belongs to a team that enforces 2FA and grants a global permission still receives that global permission even without 2FA configured, while the same requirement is correctly applied to project-, component-, and workspace-scoped permissions. Such a user can act on the granted global permission, including reaching the site management interface at /manage/. This issue is fixed in version 2026.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Weblateto a version that resolves this vulnerability.Fixed in 2026.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are affected if they use a version prior to 2026.7 and have a team that both enforces two-factor authentication and grants site-wide global permissions to its members. Project-, component-, and workspace-scoped permissions are not affected by this bypass.
What does an attacker need to exploit the bypass?
The attacker must already have a user account that belongs to a team enforcing 2FA and that receives a global permission through that team. They can use the global permission without configuring 2FA, potentially including access to the /manage/ site management interface when that permission allows it.
How can administrators determine whether they are already affected?
Review teams that require 2FA and identify whether they assign any global permissions. Check whether members of those teams have not configured 2FA but can still exercise the assigned global permissions or access /manage/.
What can be done before upgrading?
Remove or avoid granting global permissions through teams that enforce 2FA, and review existing team members for missing 2FA enrollment. Use project-, component-, or workspace-scoped permissions where appropriate, since those scopes correctly enforce the team 2FA requirement.