Is CVE-2026-55227 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55227 being exploited in the wild.

How severe is CVE-2026-55227?

Medium severity, with a CVSS score of 4.3, published 26 August 2026.

Which products and versions are affected?

weblate (PyPI) < 2026.7, ECOSYSTEM:introduced=0,fixed=2026.7.

Is there a fix for CVE-2026-55227?

Yes. weblate (PyPI): upgrade to 2026.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55227 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55227?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55227: Weblate observable object existence disclosure via HTTP status codes

Q: Which products and versions are affected?

weblate (PyPI) < 2026.7, ECOSYSTEM:introduced=0,fixed=2026.7.

Q: Is there a fix for CVE-2026-55227?

Yes. weblate (PyPI): upgrade to 2026.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55227 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55227?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55227 · Severity: medium · CVSS 4.3 · Published 2026-08-26

Weblate is a web-based translation management platform used by organizations to handle multilingual content. Multiple API endpoints in Weblate inadvertently reveal whether private projects exist by returning different HTTP status codes (403 vs. 404) depending on whether a project is present. An attacker can exploit this to discover the existence of confidential translation projects, potentially identifying sensitive business initiatives or proprietary content without proper authorization.

Technologies: weblate (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55227 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55227 being exploited in the wild.
How severe is CVE-2026-55227?: Medium severity, with a CVSS score of 4.3, published 26 August 2026.
Which products and versions are affected?: weblate (PyPI) < 2026.7, ECOSYSTEM:introduced=0,fixed=2026.7.
Is there a fix for CVE-2026-55227?: Yes. weblate (PyPI): upgrade to 2026.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55227 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55227?: Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weblate (PyPI): upgrade to 2026.7 or later
```
pip install "weblate>=2026.7"
```

Technical details

This vulnerability is an observable discrepancy (CWE-203) in Weblate's authorization logic. Several API endpoints perform global object lookups without properly enforcing access controls before responding, causing the server to return HTTP 403 (Forbidden) when a user lacks access to an existing resource, rather than HTTP 404 (Not Found) for non-existent resources. This behavioral difference is observable to unauthenticated or low-privileged users and enables enumeration of private projects. An authenticated attacker with low privileges can probe endpoint parameters to identify which private projects exist in the system. The vulnerability is present in versions prior to 2026.7 and has been patched via commit 836bc08 in pull request #19971.

Affected products

Weblate Weblate < 2026.7

Identifiers

CVE-2026-55227
GHSA-2p9g-x3cv-5hh4
PYSEC-2026-3941

Timeline

2026-07-11: disclosed
2026-07-11: patched: Version 2026.7 released
2026-08-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.