Is CVE-2026-41519 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41519 being exploited in the wild.

How severe is CVE-2026-41519?

Medium severity, with a CVSS score of 4.2, published 7 May 2026.

Which products and versions are affected?

weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.17.1.

Is there a fix for CVE-2026-41519?

Yes. weblate (PyPI): upgrade to 5.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41519 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-41519?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41519: Weblate insufficient session expiration for API tokens on password change

CVE-2026-41519 · Severity: medium · CVSS 4.2 · Published 2026-05-07

Weblate is a web-based platform used by organizations to manage software translation and localization. A security issue was identified where changing a user's password failed to revoke existing API tokens. If an account is compromised, an attacker with a stolen API token could maintain access to the platform even after the legitimate user resets their password, potentially allowing unauthorized modifications to translation data.

Technologies: weblate (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-41519 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41519 being exploited in the wild.
How severe is CVE-2026-41519?: Medium severity, with a CVSS score of 4.2, published 7 May 2026.
Which products and versions are affected?: weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.17.1.
Is there a fix for CVE-2026-41519?: Yes. weblate (PyPI): upgrade to 5.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41519 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-41519?: Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weblate (PyPI): upgrade to 5.17.1 or later
```
pip install "weblate>=5.17.1"
```

Technical details

In Weblate versions prior to 5.17.1, the password change process correctly invalidates browser sessions using 'cycle_session_keys()', but fails to revoke DRF API tokens (prefixed with 'wlu_*') stored in the 'authtoken_token' table. This results in a session management vulnerability (CWE-613) where an attacker who has obtained a user's API token can maintain access to the Weblate API even after the user has updated their credentials. The vulnerability is exploitable by an authenticated attacker who has previously compromised a token. The issue is resolved in version 5.17.1 by ensuring API tokens are regenerated by default during a password reset.

Affected products

WeblateOrg Weblate < 5.17.1

Identifiers

CVE-2026-41519
GHSA-6j8j-4qp3-36p2
PYSEC-2026-2316

Timeline

2026-04-17: patched: Fix merged into main branch
2026-04-30: advisory: Release of version 5.17.1
2026-05-07: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.