CVE-2026-62249: Weblate Information Disclosure Vulnerability

CVE-2026-62249 Overview

CVE-2026-62249 is an information disclosure vulnerability in Weblate, a web-based continuous localization platform used to manage software translations. The flaw affects Weblate versions prior to 2026.7 and allows an authenticated project user to enumerate change history for restricted components they should not be able to view. Nested API change endpoints skip the component-level access checks that direct component views enforce. The exposed data can include the restricted component identity, translation and unit links, and change payload fields such as source or translated string content in target, old, and details values. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated users can read change history and translated string content for components they are not authorized to view, breaking component-level access control in multi-tenant Weblate projects.

Affected Products

Weblate versions prior to 2026.7
Weblate nested project API change endpoints
Weblate nested component and translation API change endpoints

Discovery Timeline

2026-08-26 - CVE-2026-62249 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-62249

Vulnerability Analysis

Weblate exposes project, component, and translation resources through a REST API. Each of these resources provides a nested changes endpoint that returns change history entries. Direct component views apply component-level access checks that hide restricted components from users lacking view permission. The nested change endpoints did not apply the same checks. An authenticated user with project access could enumerate change records for any component under that project, including components explicitly restricted from them. Returned records leak component identity, translation and unit links, and payload fields including source strings, translated strings, and diff metadata stored in the target, old, and details values.

Root Cause

The root cause is a missing authorization check on the nested changes API views. The vulnerable handler built its queryset directly from obj.change_set on the parent object without filtering by the requesting user's permissions. The patch in commit a27b02110ab33995bce8cf9ea0eeddf72aa334ca replaces this call with Change.objects.last_changes(request.user, project=obj), which applies user-scoped permission filtering before returning results.

Attack Vector

Exploitation requires an authenticated account with access to a project that contains at least one restricted component. The attacker issues an HTTP GET request against the nested change endpoint for the project, component, or translation. The server returns change entries for restricted components without validating component-level visibility. No user interaction, elevated privileges, or crafted payload is required beyond a valid API token or session cookie.

python

     def changes(self, request: Request, **kwargs):
         obj = self.get_object()

-        queryset = obj.change_set.prefetch().order()
+        queryset = Change.objects.last_changes(request.user, project=obj)
         queryset = ChangesFilterBackend().filter_queryset(request, queryset, self)
         page = self.paginate_queryset(queryset)
         page = Change.objects.preload_list(page)

Source: WeblateOrg/weblate commit a27b021 — the fix routes queries through Change.objects.last_changes, which enforces per-user permission filtering.

Detection Methods for CVE-2026-62249

Indicators of Compromise

API requests from low-privilege accounts to nested change endpoints such as /api/projects/{slug}/changes/, /api/components/{project}/{slug}/changes/, or /api/translations/{project}/{component}/{lang}/changes/.
Response payloads containing component slugs or translation URLs that the requesting user cannot access through direct component endpoints.
Repeated pagination through change endpoints from a single authenticated user in a short time window.

Detection Strategies

Correlate API access logs against the user permission matrix to flag reads of change entries referencing components hidden from that user.
Alert when an account requests nested changes endpoints for projects containing restricted components without a matching direct component read.
Baseline normal per-user access to /api/*/changes/ routes and flag statistical outliers.

Monitoring Recommendations

Enable verbose API access logging in the Weblate reverse proxy or application layer, including authenticated user and request path.
Forward Weblate application and web server logs to a centralized analytics platform for user-scoped auditing.
Review audit logs for change endpoint activity by service accounts and integration tokens that should not read restricted content.

How to Mitigate CVE-2026-62249

Immediate Actions Required

Upgrade Weblate to version 2026.7 or later, which contains the fix from commit a27b021.
Rotate API tokens for any account suspected of enumerating restricted change history prior to patching.
Audit project membership and remove unnecessary access to projects that contain restricted components.

Patch Information

The issue is fixed in Weblate 2026.7. The upstream fix is documented in the GitHub Security Advisory GHSA-92m8-wv36-prmx and applied in commit a27b02110ab33995bce8cf9ea0eeddf72aa334ca. The patch replaces the unfiltered change_set queryset with Change.objects.last_changes(request.user, project=obj) to enforce component-level permissions on nested endpoints.

Workarounds

If upgrading immediately is not possible, restrict access to nested changes endpoints at the reverse proxy layer for non-administrative users.
Limit project membership so that users with access to a project do not have any restricted components hidden within that project.
Disable API token issuance for low-trust accounts until the patched version is deployed.

bash

# Example nginx rule to block nested change endpoints at the edge until patched
location ~ ^/api/(projects|components|translations)/.+/changes/?$ {
    deny all;
    return 403;
}