GHSA-2p9g-x3cv-5hh4: Medium severity pip/weblate vulnerability

Q: What level of access does an attacker need to exploit this issue?

An attacker needs network access and low-level authenticated privileges. No user interaction is required.

Q: How can I check whether my deployment exhibits the information leak?

Test requests for objects that the authenticated test user is not authorized to access. Affected endpoints may return HTTP 403 for an existing inaccessible object rather than HTTP 404, revealing that the object exists.

Q: Is a fix available?

A patch is referenced in Weblate pull request 19971. The provided information does not identify the fixed release version.

Published Aug 28, 2026

Updated

Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404.

Patches https://github.com/WeblateOrg/weblate/pull/19971

References Thanks to Yaohui Wang for reporting this via GitHub.

Affected Software

1 affected componentFixes available

pip/weblate<2026.7

2026.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/weblate to a version that resolves this vulnerability.
Fixed in 2026.7

Event History

Aug 28, 2026

Advisory Published

via GitHub·06:46 PM

Data Sourced

via GitHub·06:46 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker needs network access and low-level authenticated privileges. No user interaction is required.

How can I check whether my deployment exhibits the information leak?