Executive brief
Weblate is a web-based tool used by organizations to manage software translations and localization. A security flaw in its translation memory component allowed unauthorized users to access or modify translation data through unintended programming interfaces. This could lead to unauthorized changes to translation databases, potentially affecting the accuracy of localized software.
Technical details
A missing authorization vulnerability (CWE-862) existed in Weblate's translation memory API. The `MemoryViewSet` was incorrectly based on `ModelViewSet`, which automatically exposed write operations (create and update) that were not intended to be public or lacked proper access checks. An authenticated attacker with network access could leverage these unintended endpoints to modify translation memory entries. The fix involved transitioning the API to a `ReadOnlyModelViewSet` to restrict available operations. Users can mitigate this by blocking the `/api/memory/` path at the HTTP server level.
Affected products
- WeblateOrg Weblate < 5.17
Timeline
- 2026-03-18: patched: Pull request merged to fix the API endpoints
- 2026-04-15: disclosed: Initial disclosure and NVD publication
- 2026-04-16: advisory: GitHub Advisory published