CVE-2026-77507: Weblate Information Disclosure Vulnerability

CVE-2026-77507 Overview

CVE-2026-77507 is an information disclosure vulnerability in Weblate, a web-based continuous localization platform for managing software translations. Weblate versions prior to 2026.8 fail to apply permission checks to object-scoped RSS feeds. Unauthorized users can read change-history metadata from private projects and restricted components. On installations permitting anonymous access, attackers can retrieve this metadata without any authentication. The exposed data includes project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links. Translated string content is not included in the feed. The issue is fixed in version 2026.8 and is classified as [CWE-200] Information Exposure.

Critical Impact
Unauthenticated attackers can enumerate private project metadata, contributor identities, and activity timelines from Weblate installations, enabling reconnaissance for further targeted attacks.

Affected Products

Weblate versions prior to 2026.8
Self-hosted Weblate installations using private projects
Weblate installations with restricted components enabled

Discovery Timeline

2026-08-26 - CVE-2026-77507 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77507

Vulnerability Analysis

Weblate exposes object-scoped RSS feeds that surface recent change events for projects, components, and translations. The permission-enforcement layer applied to the standard web interface and REST API endpoints is not invoked when these feeds are generated. As a result, requests to the RSS endpoints return change-history entries regardless of whether the requesting user has authorization to view the underlying project or component.

The leaked metadata enables attackers to build a detailed activity profile of otherwise-private localization workflows. Contributor usernames and full names, action types, timestamps, and links to translations or units are all returned in the feed body. While translated string content itself is redacted, the surrounding metadata is sufficient to identify internal projects, staff involvement, and release cadence.

Root Cause

The root cause is a missing authorization check in the RSS feed generation path. Access-control logic used across the rest of the application to filter results by user permissions is not applied to feed responses. On installations that permit anonymous access, no authentication is required to reach the endpoint, so change history from restricted objects is served to any network client.

Attack Vector

An attacker sends unauthenticated HTTP requests to the object-scoped RSS feed URLs of a target Weblate instance. Because the feed omits authorization filtering, the response includes entries for private projects and restricted components alongside any public content. No user interaction or elevated privileges are required.

text

# Documentation patch clarifying the fixed behavior (docs/api.rst)
 Changes in translations are exported in RSS feeds.

+The feeds contain only changes in projects and components the requesting user
+can access.
+
 Filtered RSS feeds are available from the changes browser. These accept the same
 filters as the changes page, for example ``action``, ``user``, ``exclude_user``,
 and ``period``.

Source: WeblateOrg/weblate commit 9bcccfd

Detection Methods for CVE-2026-77507

Indicators of Compromise

Unauthenticated HTTP GET requests to Weblate RSS feed endpoints (paths ending in /rss/ or /changes/feed/) from external or unexpected source addresses.
Elevated request volume against feed URLs referencing private project or restricted component slugs.
Requests bearing RSS reader or generic HTTP client user-agent strings targeting object-scoped feed paths.

Detection Strategies

Review Weblate access logs for anonymous requests to feed endpoints that resolve to private projects or restricted components.
Correlate feed access with subsequent enumeration of contributor accounts on other exposed services.
Alert on repeated feed retrieval patterns that iterate through project or component slugs.

Monitoring Recommendations

Enable verbose HTTP access logging on the reverse proxy fronting Weblate to capture feed URL paths and response sizes.
Ingest Weblate and proxy logs into a SIEM and build detections for anonymous requests against restricted object paths.
Monitor for spikes in outbound data from feed endpoints that may indicate scraping of change history.

How to Mitigate CVE-2026-77507

Immediate Actions Required

Upgrade Weblate to version 2026.8 or later, which enforces permission checks on RSS feeds.
Audit installation settings and disable anonymous access to private projects and restricted components where feasible.
Review recent web server access logs for unauthenticated retrieval of feed endpoints tied to restricted objects.

Patch Information

The fix is delivered in Weblate 2026.8. The patch applies the same permission filtering used elsewhere in the application to object-scoped RSS feeds, ensuring that only changes for projects and components the requesting user can access are returned. See the GitHub Security Advisory GHSA-vvc6-wvqm-w5gc and the upstream commit for the code and documentation changes.

Workarounds

Restrict network access to the Weblate instance to authenticated internal users until the upgrade is applied.
Block anonymous access at the reverse proxy layer by requiring authentication on paths matching /*/rss/ and related feed endpoints.
Temporarily remove or disable private projects from the Weblate instance if metadata exposure is unacceptable and upgrading is not immediately possible.

bash

# Example nginx snippet to require authentication on Weblate RSS feed paths
location ~* /(rss|changes/feed)/ {
    auth_request /auth;
    proxy_pass http://weblate_upstream;
}