CVE-2026-77508: Weblate Auth Bypass Vulnerability

CVE-2026-77508 Overview

CVE-2026-77508 affects Weblate, a web-based localization tool used to manage translation workflows. Prior to version 2026.8, authenticated users can change an account's primary email via PUT or PATCH requests to the /api/users/{username}/ endpoint without verifying the new address. An attacker can pre-configure an account with a target email, then accept a subsequent team invitation intended for that address without controlling the recipient's mailbox. The issue is fixed in Weblate 2026.8 [CWE-302].

Critical Impact
Authenticated attackers can hijack team invitations by setting unverified email addresses on accounts they control, gaining unintended team access.

Affected Products

Weblate versions prior to 2026.8
Weblate REST API endpoint /api/users/{username}/
Self-hosted and managed Weblate deployments on affected versions

Discovery Timeline

2026-08-26 - CVE-2026-77508 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77508

Vulnerability Analysis

Weblate exposes account management functionality through its REST API. The /api/users/{username}/ endpoint accepts PUT and PATCH requests to modify account attributes, including the primary email address. In affected versions, the endpoint updates the email field directly without triggering the email verification flow that the standard web UI enforces.

This inconsistency creates an authentication assumption gap. Team invitation acceptance relies on email address matching to bind an invitee to an account. When email changes bypass verification, that binding no longer proves control of the mailbox.

The vulnerability is categorized under [CWE-302: Authentication Bypass by Assumed-Immutable Data]. The API treats the email attribute as user-controlled data suitable for direct modification, while other subsystems assume it has been verified.

Root Cause

The root cause is missing email ownership verification on the API update path. The web-based email change flow issues a confirmation link to the new address before applying the change. The REST API code path omitted this check, allowing immediate assignment of an arbitrary email to the authenticated user's profile.

Attack Vector

An authenticated attacker sends a PATCH request to /api/users/{their_username}/ with a JSON body setting email to the target victim's address. The API accepts the update without dispatching a verification challenge. When an administrator issues a team invitation to that email address, the attacker's account matches the invitation and can accept it, gaining access to the intended team resources.

Exploitation requires an existing authenticated session and user interaction from an administrator who issues the invitation. Refer to the GitHub Security Advisory GHSA-x84p-6892-473c and the GitHub Pull Request 20639 for the patch details.

Detection Methods for CVE-2026-77508

Indicators of Compromise

PUT or PATCH requests to /api/users/{username}/ that modify the email field on Weblate versions prior to 2026.8.
Account audit records showing email changes without a corresponding email verification event in application logs.
Team invitation acceptances by accounts whose primary email was modified shortly before acceptance.

Detection Strategies

Review Weblate application logs for API user-update events and correlate them with the absence of verification-token issuance for the same account.
Query the user database for accounts whose email address matches recent invitees but whose account creation predates the invitation.
Alert on rapid email changes followed by team membership changes on the same account within a short time window.

Monitoring Recommendations

Ingest Weblate API access logs and audit trail events into a centralized logging platform for correlation.
Track team invitation lifecycle events, including issuance, acceptance, and the acceptor's recent email change history.
Baseline normal API usage patterns for /api/users/ endpoints and alert on anomalies from non-administrative accounts.

How to Mitigate CVE-2026-77508

Immediate Actions Required

Upgrade Weblate to version 2026.8 or later, which enforces email verification on API-based email changes.
Audit accounts for unverified email changes that occurred prior to patching and reset those addresses to previously verified values.
Review recent team invitation acceptances and revoke access where the acceptor's email change is not accompanied by a verification event.

Patch Information

The fix is included in Weblate 2026.8. The change is implemented in GitHub Pull Request 20639, which routes API email updates through the same verification workflow used by the web UI. Vendor guidance is available in GitHub Security Advisory GHSA-x84p-6892-473c.

Workarounds

Restrict access to the /api/users/{username}/ endpoint at the reverse proxy layer until the upgrade is completed.
Require administrators to verify invitee identity out-of-band before issuing team invitations.
Disable API token issuance for untrusted accounts to limit who can invoke user-modification endpoints.

bash

# Upgrade Weblate to the patched release
pip install --upgrade "Weblate>=2026.8"

# Optional: block the vulnerable endpoint at the proxy until upgrade completes
# nginx example
# location = /api/users/ { return 403; }