CVE-2026-55228: Weblate REST API Auth Bypass Vulnerability

CVE-2026-55228 Overview

CVE-2026-55228 is a broken access control vulnerability [CWE-639] in Weblate, a web-based continuous localization platform used to manage software translations. Weblate versions prior to 2026.7 fail to enforce the scope of project- and workspace-scoped teams in the REST API. An authenticated user can submit invalid team configurations and assign projects to a team through unvalidated API requests. This grants access to projects the user is not authorized to view or manage. Successful exploitation exposes private projects and permits translation, repository, and project-management operations outside the intended permission scope. The issue is resolved in Weblate 2026.7.

Critical Impact
Authenticated users can bypass team scoping through the REST API to gain unauthorized access to private projects and perform translation, repository, and project-management operations beyond their permission scope.

Affected Products

Weblate versions prior to 2026.7
Self-hosted Weblate deployments exposing the REST API
Weblate instances using project- or workspace-scoped teams

Discovery Timeline

2026-08-26 - CVE-2026-55228 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-55228

Vulnerability Analysis

Weblate implements a team-based authorization model in which teams can be scoped to specific projects or workspaces. The REST API accepts team configuration updates but does not verify that the requested project assignments remain within the team's declared scope. An authenticated user with permission to modify a scoped team can submit team-assignment requests that reference projects outside their access boundary. The server accepts these requests and effectively expands the team's project membership.

The result is a horizontal privilege escalation. Attackers gain read and write access to private projects, translations, and Git repositories linked to those projects. The flaw sits in the API serializer layer rather than in the underlying permission model, meaning the UI-enforced scope is bypassed by direct API calls.

Root Cause

The root cause is missing validation in the REST API serializers for team objects. The patch introduces the SELECTION_MANUAL constraint in weblate/api/serializers.py to restrict which project assignments are permitted on scoped teams. Prior to the fix, scoped team assignments could be expanded through the API without the server rechecking the team's scope, satisfying the CWE-639 pattern of authorization on a user-controlled key.

Attack Vector

The attack requires network access to the Weblate REST API and a valid authenticated session with permission to edit at least one scoped team. No user interaction is required. The attacker issues a crafted API request that assigns additional projects to the scoped team, then uses the team's membership to access those projects.

text

# Excerpt from docs/changes.rst in the fix commit
.. rubric:: Bug fixes

+* Scoped team assignments can no longer be expanded through the API.
 * TBX glossary files no longer duplicate terms when repeated pending add operations are saved.
 * :ref:`code-hosting-gerrit` review pushes can again include Gerrit push options in the target branch.
 * Webhook target fallback matching is now stricter and reported in component diagnostics.

Source: Weblate commit 19babc9

python

# Excerpt from weblate/api/serializers.py in the fix commit
from weblate.accounts.models import Subscription
from weblate.addons.models import ADDONS, Addon
+from weblate.auth.data import SELECTION_MANUAL
from weblate.auth.models import Group, Permission, Role, User
from weblate.auth.results import PermissionResult
from weblate.checks.models import CHECKS

Source: Weblate commit 19babc9. The patch imports SELECTION_MANUAL and applies it in the serializer to reject scoped-team assignments that fall outside the team's original selection.

Detection Methods for CVE-2026-55228

Indicators of Compromise

REST API PATCH or PUT requests to /api/groups/ endpoints that add projects not previously associated with a scoped team.
Audit-log entries showing team membership changes without a corresponding administrative UI session.
Unexpected access events on private projects originating from user accounts whose team scope should not include those projects.

Detection Strategies

Correlate Weblate application logs with the request source and authenticated user to identify team modifications performed exclusively over the API.
Diff current team-to-project mappings against a known-good baseline and alert on scoped teams that reference projects outside their declared scope.
Review Git repository access logs for pulls, pushes, or translation commits by users who obtained access through recently modified team assignments.

Monitoring Recommendations

Enable verbose audit logging for weblate.auth.models.Group changes and forward events to a centralized SIEM.
Alert on high rates of team-configuration API calls from a single user or API token.
Monitor for privileged translation, repository, and project-management operations performed by accounts shortly after team membership changes.

How to Mitigate CVE-2026-55228

Immediate Actions Required

Upgrade Weblate to version 2026.7 or later, where the API serializer enforces SELECTION_MANUAL on scoped team assignments.
Rotate API tokens for accounts that had permission to edit scoped teams and review recent team-configuration activity.
Audit all project- and workspace-scoped teams to confirm current project assignments match intended scope, and revert unauthorized additions.

Patch Information

The fix is included in Weblate 2026.7. The relevant commit is WeblateOrg/weblate@19babc9, documented in GitHub Security Advisory GHSA-2q2q-jr9g-v9rf. The patch adds validation in weblate/api/serializers.py so that scoped teams cannot be expanded to include projects outside their original selection.

Workarounds

Restrict which users hold the permission to edit team objects until the upgrade is complete.
Place the REST API behind an authenticating reverse proxy and deny PATCH, PUT, and POST requests to /api/groups/ endpoints for non-administrative accounts.
Temporarily convert project- and workspace-scoped teams to explicit manual membership until the patched version is deployed.

bash

# Example: upgrade a pip-based Weblate deployment to the patched release
pip install --upgrade "Weblate>=2026.7"
weblate migrate
weblate collectstatic --noinput
systemctl restart weblate.service weblate-celery.service