CVE-2026-55227: Weblate Information Disclosure Vulnerability

CVE-2026-55227 Overview

CVE-2026-55227 is an information disclosure vulnerability in Weblate, a web-based localization tool. Versions prior to 2026.7 perform globally scoped object lookups on several HTML and AJAX endpoints instead of restricting queries to projects the requesting user can access. As a result, the application returns HTTP 403 (Forbidden) when a user requests an object that exists in a private project they lack permission to view, and HTTP 404 (Not Found) when the object does not exist. This response discrepancy lets an authenticated attacker enumerate whether specific objects exist in private Weblate projects. The issue is tracked under [CWE-203: Observable Discrepancy] and is fixed in Weblate 2026.7.

Critical Impact
Authenticated users can enumerate the existence of objects in private Weblate projects by observing HTTP status code differences between authorized and unauthorized requests.

Affected Products

Weblate versions prior to 2026.7
Self-hosted Weblate deployments serving multi-tenant private projects
Weblate instances relying on HTML and AJAX object lookup endpoints for access control

Discovery Timeline

2026-08-26 - CVE-2026-55227 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-55227

Vulnerability Analysis

Weblate exposes multiple HTML and AJAX endpoints that resolve project, component, translation, and related objects by identifier. Prior to 2026.7, these endpoints called get_object_or_404 against the global object set before evaluating whether the requesting user held access rights to the parent project. When the lookup succeeded but the permission check failed, Weblate returned HTTP 403. When the lookup itself failed, Weblate returned HTTP 404. An authenticated attacker can iterate over identifiers and observe the returned status code to infer which objects exist inside private projects. This leaks the existence, structure, and naming of otherwise confidential translation workflows, though it does not disclose the contents of those objects.

Root Cause

The root cause is a violation of access control ordering. Object retrieval was not scoped to the querysets the user is authorized to see, so the presence check and the authorization check produced distinguishable outcomes. This is a classic observable discrepancy pattern [CWE-203], where side-channel information from the response contradicts the intent of the access control layer.

Attack Vector

Exploitation requires network access to the Weblate instance and a valid authenticated session with low privileges. An attacker enumerates candidate identifiers (project slugs, component names, translation keys) and records the HTTP response code for each request. A 403 response confirms the object exists in a private project; a 404 confirms it does not. No user interaction is required beyond the attacker's own session, and no elevation of privilege or data modification occurs.

python

# Patch excerpt from weblate/auth/models.py
# Source: https://github.com/WeblateOrg/weblate/commit/836bc082803d49d02f2831ec8339268eb66bcdae
    def needs_project_filter(self):
        if self.is_superuser:
            return False
        if any(
            key > 0 and permissions == [(None, None)]
            for key, permissions in self.project_permissions.items()
        ):
            return True
        if self.project_permissions[-SELECTION_ALL]:
            return False
        return Project.objects.exclude(

The fix embeds access checks directly into get_object_or_404 calls so that unauthorized objects appear as non-existent (404), collapsing the 403/404 distinction. See the GitHub Security Advisory GHSA-2p9g-x3cv-5hh4 for the full advisory.

Detection Methods for CVE-2026-55227

Indicators of Compromise

High volume of HTTP 403 and 404 responses from a single authenticated session across sequentially or programmatically varied URL paths.
Sustained enumeration patterns targeting /projects/, /component/, or translation object endpoints from a low-privileged user account.
Requests that iterate through predictable identifiers within short time windows against non-public project slugs.

Detection Strategies

Instrument web access logs to flag authenticated users generating disproportionate ratios of 403 versus 200 responses against project endpoints.
Alert on rapid, sequential access attempts to object lookup routes from a single session or IP address.
Correlate 403 responses on private-project routes with the authenticated user's expected project scope to identify probing behavior.

Monitoring Recommendations

Forward Weblate reverse proxy or application logs to a centralized SIEM for rate and pattern analysis.
Track baseline 403/404 response rates per authenticated user and alert on statistical deviations.
Review audit logs of user account activity for enumeration attempts preceding social engineering or targeted intrusion attempts.

How to Mitigate CVE-2026-55227

Immediate Actions Required

Upgrade all Weblate instances to version 2026.7 or later, which embeds access checks into object lookup calls.
Audit authenticated user accounts and revoke access for stale or unnecessary low-privilege accounts that could be used to enumerate objects.
Review reverse proxy and Weblate application logs for prior enumeration patterns using 403/404 response discrepancies.

Patch Information

The vulnerability is remediated by commit 836bc082803d49d02f2831ec8339268eb66bcdae, released in Weblate 2026.7. The patch hardens HTML and AJAX object lookups against private project enumeration by scoping get_object_or_404 queries to projects the user is authorized to access, returning a uniform 404 response for both non-existent and unauthorized objects. Refer to the GitHub Security Advisory GHSA-2p9g-x3cv-5hh4 for advisory details.

Workarounds

Restrict registration and disable self-service account creation on Weblate instances hosting private projects until the patch is applied.
Place Weblate behind a reverse proxy or WAF and rate-limit authenticated requests to object lookup endpoints to slow enumeration.
Use unpredictable project and component slugs to reduce the practicality of identifier guessing until upgrade is complete.

bash

# Upgrade Weblate to the patched release using pip
pip install --upgrade 'Weblate>=2026.7'

# Verify installed version
weblate --version