GHSA-2q2q-jr9g-v9rf: High severity pip/Weblate vulnerability
Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.
Patches https://github.com/WeblateOrg/weblate/pull/19970
References
Parts of this issue were independently reported by four reporters: @H3xV0rT3x via GitHub imhego via HackerOne v01demort via HackerOne b4nder via HackerOne
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Weblateto a version that resolves this vulnerability.Fixed in 2026.7
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low privileges. An authenticated user with the ability to interact with the affected API could set invalid project- or workspace-scoped team configurations.
What could an attacker gain through a successful exploit?
An attacker could grant access to projects they do not have access to. The reported impact includes high confidentiality and integrity impact, with no availability impact indicated.
Which configurations are affected?
The issue concerns API handling of project-scoped and workspace-scoped teams. It allowed invalid configurations involving team access to projects.
What remediation is identified?
The advisory identifies a patch in Weblate pull request 19970. No affected or fixed software version is provided in the available data.