CVE-2026-21889: Weblate Information Disclosure Flaw

CVE-2026-21889 Overview

CVE-2026-21889 is an improper access control vulnerability in Weblate, a web-based localization tool. Prior to version 5.15.2, screenshot images were served directly by the HTTP server without proper access control mechanisms. This flaw allows unauthenticated users to potentially access screenshot files by guessing their filenames, leading to information disclosure.

Critical Impact

Unauthenticated users may access sensitive screenshot images by guessing filenames, potentially exposing confidential translation project content and internal application interfaces.

Affected Products

• Weblate versions prior to 5.15.2

Discovery Timeline

• 2026-01-14 - CVE-2026-21889 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-21889

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control), where the application fails to properly restrict access to screenshot resources. The core issue stems from Weblate's architecture for serving static media files. Screenshot images uploaded to translation projects were stored in the /media/ directory and served directly by the HTTP server without authentication checks.

The network-accessible attack vector requires an attacker to guess or enumerate screenshot filenames. While the attack complexity is elevated due to the filename guessing requirement, successful exploitation could expose sensitive visual content from translation projects, including application screenshots containing proprietary interfaces, unreleased features, or confidential business information.

Root Cause

The root cause lies in the improper separation between authenticated application resources and static file serving. The /media/ directory was configured to serve screenshot files directly through the web server without routing requests through Weblate's authentication layer. This architectural decision prioritized performance over security, allowing any user with knowledge of the file path to access screenshots without authentication.

Attack Vector

An attacker can exploit this vulnerability through the following mechanism:

1. Identify the Weblate instance's media URL structure (typically /media/screenshots/)
2. Attempt to enumerate or guess screenshot filenames
3. Directly request screenshot URLs without authentication
4. Access potentially sensitive visual content from translation projects

The fix implemented in version 5.15.2 introduces a proxied screenshot view that routes all screenshot requests through the application's access control layer, ensuring only authorized users can access these resources.

The following documentation patch shows how the vulnerability was addressed:

 Serving static files
 ++++++++++++++++++++
 
+.. versionchanged:: 5.15.2
+   :file:`/media/` is no longer used for serving screenshots.
+
 Django needs to collect its static files in a single directory. To do so,
 execute :samp:`weblate collectstatic --noinput`. This will copy the static
 files into a directory specified by the :setting:`django:STATIC_ROOT` setting (this defaults to

Source: GitHub Commit Details

The Docker configuration was also updated to remove direct media URL serving:

 
    Configures URL prefix where Weblate is running, see :setting:`URL_PREFIX`.
 
-.. envvar:: WEBLATE_MEDIA_URL
-
-   Configures URL that handles the media served from
-   :setting:`django:MEDIA_ROOT`.
-
 .. envvar:: WEBLATE_STATIC_URL
 
    Configures URL prefix for static files server from :setting:`CACHE_DIR`.

Source: GitHub Commit Details

Detection Methods for CVE-2026-21889

Indicators of Compromise

• Unusual access patterns to /media/screenshots/ or similar media paths from unauthenticated sessions
• HTTP 200 responses for screenshot requests without corresponding authentication tokens
• Sequential or enumeration-style requests to media URLs suggesting filename brute-forcing
• Access logs showing direct media file requests bypassing the application layer

Detection Strategies

• Monitor web server access logs for requests to /media/ paths that bypass application routing
• Implement alerting on high-volume requests to static media directories from single IP addresses
• Review Weblate version deployed and compare against the patched version 5.15.2
• Audit web server configuration to verify screenshot requests are properly proxied through Weblate

Monitoring Recommendations

• Enable detailed access logging on the web server for all media directory requests
• Configure rate limiting on media endpoints to prevent enumeration attacks
• Set up alerts for failed or anomalous access attempts to screenshot directories
• Regularly audit project screenshots for sensitive content that could be exposed

How to Mitigate CVE-2026-21889

Immediate Actions Required

• Upgrade Weblate to version 5.15.2 or later immediately
• Review access logs for any unauthorized access to screenshot files prior to patching
• Audit existing screenshots for sensitive content and consider removing or restricting access
• Verify web server configuration no longer serves /media/ directly after upgrade

Patch Information

The vulnerability is fixed in Weblate version 5.15.2. The patch introduces a proxied screenshot view that enforces proper access control. Organizations should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, refer to:

• GitHub Security Advisory GHSA-3g2f-4rjg-9385
• GitHub Pull Request #17516
• GitHub Commit a6eb5fd

Workarounds

• Restrict access to the /media/ directory at the web server level using authentication rules
• Implement IP-based access restrictions for media directories if upgrading is not immediately possible
• Move sensitive screenshots to a non-web-accessible location temporarily
• Configure web server to proxy all media requests through Weblate's application layer

# Example nginx configuration to restrict media access (temporary workaround)
# Add authentication requirement for media directory
location /media/ {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    alias /path/to/weblate/media/;
}