CVE-2026-77573
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Weblate prior to 2026.8 allows a user with permission to manage component repository URLs to perform SSRF against internal services through DNS rebinding during VCS operations. Hostname validation uses the first DNS resolution, but VCS clients perform a separate lookup, allowing redirection to an internal address.
Risk Assessment
An attacker could access internal VCS services and potentially expose private repository contents, leading to sensitive data leakage.
Recommendation
Upgrade Weblate to version 2026.8 or later. Restrict the ability to add untrusted repository hosts.
Other vulnerabilities in Weblate
See all- CVE-2026-41654High
Weblate is a web-based localization tool. Prior to version 5.17.1, an authenticated user with project.add permissions could import a crafted project backup ZIP containing an attacker-chosen repo URL, potentially leading to data exposure.
- CVE-2026-21889High
Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
- CVE-2025-64725Critical
Weblate before version 5.15 allows accepting an invitation opened by a different user. Version 5.15 contains a patch.
- CVE-2026-77507Medium
Weblate prior to version 2026.8 does not apply permission checks in object-scoped RSS feeds, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations with anonymous access, metadata can be retrieved without authentication. This issue is fixed in version 2026.8.
- CVE-2026-62326Medium
Weblate prior to version 2026.7 allows a user with the "Edit source" role to store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. This issue is fixed in version 2026.7.
- CVE-2026-62249Medium
Weblate prior to version 2026.7 allows an authenticated user with access to a project to retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. This issue is fixed in version 2026.7.
- CVE-2026-61792High
Weblate is a web-based continuous localization platform. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without confining them to the repository. This is an incomplete fix for CVE-2026-34242, allowing arbitrary file read. A user with project-admin privileges can disclose file contents on the host. Fixed in 2026.7.
- CVE-2026-61790Medium
Weblate prior to version 2026.7 does not enforce two-factor authentication (2FA) requirements for site-wide global permissions, even though a team can require 2FA for its members. A user belonging to a team with 2FA enforcement receives global permissions without 2FA configured, potentially including access to the site management interface. This issue is fixed in version 2026.7.
- CVE-2026-55228High
Weblate is a web-based continuous localization platform. In versions prior to 2026.7, the REST API did not properly enforce team scopes, allowing users to submit invalid team configurations. By assigning projects to teams via unvalidated requests, users could grant access to unauthorized projects. This could expose private projects and allow operations outside intended permissions. Fixed in 2026.7.
- CVE-2026-55227Medium
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
Original NVD description (English source)
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCS_RESTRICT_PRIVATE=True are affected. This issue is fixed in version 2026.8.