Executive brief
Weblate is a web-based translation management platform. An insecure direct object reference (IDOR) vulnerability in the GroupViewSet API endpoint allows an authenticated project manager to bypass access controls and view or modify private translation projects they should not have permission to access. This could lead to unauthorized access to sensitive translation data and project configurations.
Technical details
The vulnerability is an insecure direct object reference (IDOR) flaw classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The GroupViewSet API endpoint fails to properly validate project- and workspace-scoped team access controls, allowing authenticated users with project manager privileges to modify team configurations and grant themselves access to private projects they do not have authorization to view or edit. The attack requires prior authentication but no additional user interaction. An attacker can exploit this to read and modify data in any private project, compromising project confidentiality and integrity. A patch is available in version 2026.7, released via PR #19970.
Affected products
- WeblateOrg Weblate < 2026.7
Timeline
- 2026-07-11: disclosed
- 2026-07-11: patched: Fixed in version 2026.7
- 2026-08-28: advisory: Published to GitHub Advisory Database