CVE-2026-61790: Weblate 2FA Bypass Vulnerability

CVE-2026-61790 Overview

CVE-2026-61790 is an access control weakness [CWE-284] in Weblate, a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, teams that require two-factor authentication (2FA) before granting permissions fail to enforce this requirement for site-wide global permissions. A user assigned to a 2FA-enforcing team receives that team's global permissions even without configuring 2FA. The same enforcement correctly applies to project-, component-, and workspace-scoped permissions. Affected users can act on the granted global permission, including reaching the site management interface at /manage/. The issue is fixed in Weblate version 2026.7.

Critical Impact
Users without configured 2FA can exercise team-granted global permissions and reach the Weblate site management interface, violating the tenant's enforced authentication policy.

Affected Products

Weblate versions prior to 2026.7
Self-hosted Weblate instances using team-based 2FA enforcement
Weblate deployments assigning global permissions through teams

Discovery Timeline

2026-08-26 - CVE-2026-61790 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-61790

Vulnerability Analysis

Weblate teams can require members to configure 2FA before receiving team-derived permissions. The authorization logic applies this gating check when evaluating project-, component-, and workspace-scoped permissions but omits the same check for site-wide global permissions. A user who has not configured 2FA still inherits any global permission granted through a 2FA-enforcing team.

The practical impact is that a user can bypass the tenant's stated authentication policy for the highest-privilege scope. This includes access to the site management interface at /manage/, which is normally reserved for administrative operations. The vulnerability is scoped to authenticated users who already belong to a privileged team, so exploitation requires prior team membership.

The fix in version 2026.7 extends the 2FA enforcement check to site-wide permissions, so team-derived global permissions are withheld from human members without 2FA configured.

Root Cause

The root cause is a missing authorization check [CWE-284] in the permission resolution path for global scope. The team-level enforced_2fa predicate was evaluated on project, component, and workspace scopes but not on the global scope, producing an inconsistent access control decision across scopes.

Attack Vector

An authenticated user who is a member of a team that grants global permissions and enforces 2FA can log in with only single-factor credentials and still exercise those global permissions. If the account credentials are compromised through phishing or credential reuse, the attacker gains the team's global privileges without needing to defeat the second factor.

text

// Patch excerpt: docs/changes.rst
.. rubric:: Compatibility

+* Teams enforcing two-factor authentication now also withhold site-wide permissions from human members without 2FA configured.
* :ref:`addon-weblate.fedora_messaging.publish` topics now include category path segments, and broker settings are stored as an AMQP URL with existing host and SSL settings migrated automatically.

.. rubric:: Upgrading
// Source: https://github.com/WeblateOrg/weblate/commit/89042ab12268842655ddc10cb052bfc4dfa7a589

text

// Patch excerpt: docs/security/threat-model.rst
- management permissions. *(documented)* (source: :doc:`/admin/access`)
+ management permissions. *(documented)* (source: :doc:`/admin/access`,
+   :doc:`/admin/auth`)
- Permission assignments match the intended trust relationship.
+   Team-level enforced 2FA is satisfied by human users before
+   team-derived permissions apply.
// Source: https://github.com/WeblateOrg/weblate/commit/89042ab12268842655ddc10cb052bfc4dfa7a589

Detection Methods for CVE-2026-61790

Indicators of Compromise

Access to /manage/ by user accounts without a registered second-factor device.
Administrative actions performed by team members whose profile shows 2FA not configured.
Session activity where a global permission is exercised but the authentication log records only password-based login.

Detection Strategies

Correlate Weblate audit logs with user 2FA configuration state to identify privileged actions performed by non-2FA accounts.
Review team assignments for teams that both grant global permissions and set enforced_2fa, and enumerate members lacking 2FA.
Alert on any authenticated request to /manage/ originating from a session that did not complete a second-factor challenge.

Monitoring Recommendations

Forward Weblate application and access logs to a centralized logging platform and retain them for privileged-action review.
Monitor /manage/ and other administrative endpoints for anomalous access patterns and new users.
Track changes to team membership and permission scope so that global-permission grants are reviewed against 2FA enrollment status.

How to Mitigate CVE-2026-61790

Immediate Actions Required

Upgrade Weblate to version 2026.7 or later, where 2FA enforcement now applies to site-wide permissions.
Audit all teams granting global permissions and require every member to enroll in 2FA before the upgrade window.
Review recent activity in /manage/ and other administrative surfaces performed by accounts without 2FA.

Patch Information

The fix is included in Weblate 2026.7. The upstream change is available in the GitHub commit 89042ab and documented in the GitHub Security Advisory GHSA-x86c-ff69-cr2m.

Workarounds

Remove global permissions from teams until all members have enrolled in 2FA, restricting privileged scopes to project or component level.
Require 2FA at the identity provider layer for all users who can log in to Weblate, removing single-factor login as an option.
Manually revoke sessions and force re-authentication for users with global permissions who have not configured 2FA.

bash

# Upgrade Weblate via pip in an isolated environment
pip install --upgrade 'Weblate>=2026.7'

# Verify installed version
weblate --version

# Enumerate users without 2FA who hold global permissions (Django shell)
weblate shell -c "from weblate.auth.models import User; \
print([u.username for u in User.objects.filter(is_superuser=True) if not u.profile.has_2fa])"