Executive brief
Weblate is a web-based translation management platform used by organizations to handle multilingual content. Multiple API endpoints in Weblate inadvertently reveal whether private projects exist by returning different HTTP status codes (403 vs. 404) depending on whether a project is present. An attacker can exploit this to discover the existence of confidential translation projects, potentially identifying sensitive business initiatives or proprietary content without proper authorization.
Technical details
This vulnerability is an observable discrepancy (CWE-203) in Weblate's authorization logic. Several API endpoints perform global object lookups without properly enforcing access controls before responding, causing the server to return HTTP 403 (Forbidden) when a user lacks access to an existing resource, rather than HTTP 404 (Not Found) for non-existent resources. This behavioral difference is observable to unauthenticated or low-privileged users and enables enumeration of private projects. An authenticated attacker with low privileges can probe endpoint parameters to identify which private projects exist in the system. The vulnerability is present in versions prior to 2026.7 and has been patched via commit 836bc08 in pull request #19971.
Affected products
- Weblate Weblate < 2026.7
Timeline
- 2026-07-11: disclosed
- 2026-07-11: patched: Version 2026.7 released
- 2026-08-28: advisory