CVE-2026-33220: Weblate Auth Bypass Vulnerability

CVE-2026-33220 Overview

CVE-2026-33220 is a Broken Access Control vulnerability affecting Weblate, a popular web-based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints that failed to perform proper access control checks. This vulnerability could allow authenticated attackers to access sensitive translation data across project boundaries, potentially leading to information disclosure.

Critical Impact

Authenticated users can bypass access controls to retrieve confidential translation memory data from projects they should not have access to, potentially exposing proprietary content and intellectual property.

Affected Products

• Weblate versions prior to 5.17
• Weblate installations with translation memory API enabled
• Self-hosted and cloud deployments using affected versions

Discovery Timeline

• April 15, 2026 - CVE-2026-33220 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33220

Vulnerability Analysis

This vulnerability stems from inadequate access control implementation in Weblate's translation memory API. The translation memory feature stores previously translated strings to assist translators with consistency and efficiency. However, the API endpoints responsible for serving this data were inadvertently exposed without proper authorization checks.

When a low-privileged authenticated user makes requests to the translation memory API, the system fails to verify whether the requesting user has appropriate permissions to access the requested project's translation data. This allows attackers to enumerate and retrieve translation memory entries from projects they are not authorized to view.

The vulnerability is classified under CWE-22 (Path Traversal), indicating that the improper access control may involve path-based resource access without proper validation of user permissions.

Root Cause

The root cause lies in the translation memory API's failure to implement consistent access control checks across all exposed endpoints. While some API endpoints properly validated user permissions, certain unintended endpoints were exposed without equivalent security measures. This inconsistency created a gap where authenticated users could craft requests to bypass the intended access control model.

The CDN add-on integration may have contributed to this exposure, as the endpoints were designed for content delivery scenarios where access control assumptions differed from the standard API.

Attack Vector

The attack vector for CVE-2026-33220 is network-based and requires:

1. Authentication: The attacker must have valid credentials to the Weblate instance
2. API Access: The attacker crafts requests to the exposed translation memory endpoints
3. Enumeration: By iterating through project identifiers or using discovered endpoint patterns, the attacker can retrieve translation data from unauthorized projects
4. Data Exfiltration: Sensitive translation content, potentially including proprietary terminology, product names, or confidential communications, can be extracted

The vulnerability requires user interaction in the sense that the attacker needs to authenticate first, and the scope is changed (indicated by S:C in the CVSS vector) meaning the vulnerable component can impact resources beyond its security scope.

Detection Methods for CVE-2026-33220

Indicators of Compromise

• Unusual API request patterns to translation memory endpoints from users with limited project access
• High-volume requests to /api/ endpoints related to translation memory from single user accounts
• Access log entries showing translation memory queries for projects the authenticated user is not a member of
• Anomalous data retrieval volumes that exceed normal translation workflow patterns

Detection Strategies

• Implement API request logging and monitor for access patterns to translation memory endpoints
• Create alerts for authenticated users accessing translation memory data across multiple projects in short timeframes
• Deploy application-layer monitoring to detect unauthorized cross-project data access attempts
• Review access logs for discrepancies between user project memberships and translation memory API requests

Monitoring Recommendations

• Enable verbose logging on the Weblate application to capture all API requests with user context
• Monitor network traffic for unusual patterns targeting the translation memory API endpoints
• Implement rate limiting on sensitive API endpoints to slow potential data exfiltration
• Configure security information and event management (SIEM) rules to correlate authentication events with API access anomalies

How to Mitigate CVE-2026-33220

Immediate Actions Required

• Upgrade Weblate to version 5.17 or later immediately
• If immediate upgrade is not possible, disable the CDN add-on feature as a temporary workaround
• Audit access logs to determine if any unauthorized access has already occurred
• Review user permissions and ensure principle of least privilege is enforced across all projects

Patch Information

The vulnerability has been addressed in Weblate version 5.17. The fix ensures that all translation memory API endpoints perform proper access control validation before returning data. For detailed information about the patch implementation, refer to the GitHub Pull Request #18516 and the GitHub Security Advisory.

Workarounds

• Disable the CDN add-on feature if it is not required, as this feature is not enabled by default
• Implement network-level access controls to restrict API access to trusted IP ranges
• Consider temporarily disabling the translation memory API if sensitive data is at risk until patching is complete
• Deploy a web application firewall (WAF) rule to monitor and potentially block suspicious requests to translation memory endpoints

Since no verified code examples are available for this vulnerability, administrators should consult the official security advisory and pull request linked above for technical implementation details of the fix.