Is CVE-2026-44263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44263 being exploited in the wild.

How severe is CVE-2026-44263?

Medium severity, with a CVSS score of 4.3, published 7 May 2026.

Which products and versions are affected?

weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.17.1.

Is there a fix for CVE-2026-44263?

Yes. weblate (PyPI): upgrade to 5.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44263 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-44263?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44263: Weblate translation enumeration via API information disclosure

CVE-2026-44263 · Severity: medium · CVSS 4.3 · Published 2026-05-07

Weblate, a web-based translation and localization platform, contained a security flaw in its programming interface (API). An authenticated user could exploit this to determine the existence of translation projects and components they were not authorized to see. This could lead to the exposure of private project names or internal organizational structures.

Technologies: weblate (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44263 being exploited in the wild.
How severe is CVE-2026-44263?: Medium severity, with a CVSS score of 4.3, published 7 May 2026.
Which products and versions are affected?: weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.17.1.
Is there a fix for CVE-2026-44263?: Yes. weblate (PyPI): upgrade to 5.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44263 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-44263?: Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weblate (PyPI): upgrade to 5.17.1 or later
```
pip install "weblate>=5.17.1"
```

Technical details

An information disclosure vulnerability exists in Weblate's REST API due to insufficient access-filtered querysets in several endpoints, including screenshots, tasks, and component links. Specifically, the application failed to properly validate if a requesting user had permissions for a specific translation or component before returning a response that confirmed its existence (CWE-203). An authenticated attacker could use these API parameters to enumerate the names and existence of private projects or translations they cannot otherwise access. The fix, introduced in version 5.17.1, implements 'filter_access(user)' checks and ensures that lookups for categories and components are strictly scoped to the projects the user is authorized to view.

Affected products

WeblateOrg Weblate < 5.17.1

Identifiers

CVE-2026-44263
GHSA-gcg5-86jr-f7jg
PYSEC-2026-2318

Timeline

2026-04-27: patched: Fix committed to repository
2026-04-30: advisory: Release 5.17.1 published
2026-05-07: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.