Executive brief
Weblate has improper validation upon invitation acceptance
Affected products
- PyPI weblate
Junglewise Threat Intelligence
CVE-2025-64725: PYSEC-2026-2042 - Weblate has improper validation upon invitation acceptance
CVE-2025-64725 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: weblate (PyPI). Vendors: PyPI.
Related threats
- Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did
- Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather
- PYSEC-2026-2037 - Weblate leaks information via screenshots
- PYSEC-2026-2040 - Weblate has an arbitrary file read via symbolic links
- PYSEC-2026-2036 - Weblate has a long session expiry when verifying second factor