# CVE-2026-44263: Weblate translation enumeration via API information disclosure

Source: https://junglewise.ai/threats/cve-2026-44263-weblate-translation-enumeration-via-api-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-44263 · Severity: medium · CVSS 4.3 · Published 2026-05-07

Weblate, a web-based translation and localization platform, contained a security flaw in its programming interface (API). An authenticated user could exploit this to determine the existence of translation projects and components they were not authorized to see. This could lead to the exposure of private project names or internal organizational structures.

Technologies: [weblate (PyPI)](https://junglewise.ai/threats/technologies/weblate). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44263 being exploited in the wild.

**How severe is CVE-2026-44263?** Medium severity, with a CVSS score of 4.3, published 7 May 2026.

**Which products and versions are affected?** weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.17.1.

**Is there a fix for CVE-2026-44263?** Yes. weblate (PyPI): upgrade to 5.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44263 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44263?** Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- weblate (PyPI): upgrade to 5.17.1 or later

  ```sh
  pip install "weblate>=5.17.1"
  ```


## Technical details

An information disclosure vulnerability exists in Weblate's REST API due to insufficient access-filtered querysets in several endpoints, including screenshots, tasks, and component links. Specifically, the application failed to properly validate if a requesting user had permissions for a specific translation or component before returning a response that confirmed its existence (CWE-203). An authenticated attacker could use these API parameters to enumerate the names and existence of private projects or translations they cannot otherwise access. The fix, introduced in version 5.17.1, implements 'filter_access(user)' checks and ensures that lookups for categories and components are strictly scoped to the projects the user is authorized to view.

## Affected products

- WeblateOrg Weblate < 5.17.1

## Identifiers

- CVE-2026-44263
- GHSA-gcg5-86jr-f7jg
- PYSEC-2026-2318

## Timeline

- 2026-04-27: patched: Fix committed to repository
- 2026-04-30: advisory: Release 5.17.1 published
- 2026-05-07: disclosed: CVE published

## References

- [https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203](https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203)
- [https://github.com/WeblateOrg/weblate/pull/19258](https://github.com/WeblateOrg/weblate/pull/19258)
- [https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1](https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1)
- [https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg](https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg)

## Related threats

- [Weblate IDOR in GroupViewSet authorization bypass](https://junglewise.ai/threats/cve-2026-55228-weblate-idor-in-groupviewset-authorization-bypass)
- [Weblate observable object existence disclosure via HTTP status codes](https://junglewise.ai/threats/cve-2026-55227-weblate-observable-object-existence-disclosure-via-http-status)
- [PYSEC-2026-2037 - Weblate leaks information via screenshots](https://junglewise.ai/threats/cve-2026-21889-weblate-information-disclosure-via-unprotected-screenshots)
- [PYSEC-2026-2040 - Weblate has an arbitrary file read via symbolic links](https://junglewise.ai/threats/cve-2025-68279-weblate-has-an-arbitrary-file-read-via-symbolic-links)
- [PYSEC-2026-2036 - Weblate has a long session expiry when verifying second factor](https://junglewise.ai/threats/cve-2025-58352-weblate-weak-session-expiry-during-second-factor-verification)