Is CVE-2025-67715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67715 being exploited in the wild.

How severe is CVE-2025-67715?

Medium severity, with a CVSS score of 4.3, published 16 December 2025.

Which products and versions are affected?

weblate (PyPI) < 5.15, ECOSYSTEM:introduced=0,fixed=5.15.

Is there a fix for CVE-2025-67715?

Yes. weblate (PyPI): upgrade to 5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-67715 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-67715?

Check whether you run weblate (PyPI) or Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67715: Weblate IDOR user and project enumeration in REST API

Q: Which products and versions are affected?

weblate (PyPI) < 5.15, ECOSYSTEM:introduced=0,fixed=5.15.

Q: Is there a fix for CVE-2025-67715?

Yes. weblate (PyPI): upgrade to 5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-67715 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-67715?

Check whether you run weblate (PyPI) or Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67715 · Severity: medium · CVSS 4.3 · Published 2025-12-16

Weblate, a web-based translation management system, contained a security flaw in its programming interface (API). An authenticated user could exploit this to view a full list of other users on the system and access their private notification settings. This could lead to the exposure of internal user lists and organizational project structures.

Technologies: weblate (PyPI), Weblate. Vendors: PyPI, Weblate.

Quick answers

Is CVE-2025-67715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67715 being exploited in the wild.
How severe is CVE-2025-67715?: Medium severity, with a CVSS score of 4.3, published 16 December 2025.
Which products and versions are affected?: weblate (PyPI) < 5.15, ECOSYSTEM:introduced=0,fixed=5.15.
Is there a fix for CVE-2025-67715?: Yes. weblate (PyPI): upgrade to 5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67715 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-67715?: Check whether you run weblate (PyPI) or Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weblate (PyPI): upgrade to 5.15 or later
```
pip install "weblate>=5.15"
```

Technical details

Weblate is vulnerable to Insecure Direct Object Reference (IDOR) and broken authorization within its REST API. The flaw allows an authenticated attacker with low privileges to bypass intended access controls to list all registered users and retrieve individual user notification settings. This systematic enumeration is caused by improper authorization checks (CWE-285) when accessing specific API endpoints. The vulnerability is addressed in Weblate version 5.15.

Affected products

WeblateOrg Weblate < 5.15

Identifiers

CVE-2025-67715
GHSA-3pmh-24wp-xpf4
PYSEC-2025-233

Timeline

2025-12-15: advisory: GitHub Advisory published
2025-12-15: patched: Fix merged in version 5.15

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.