Is CVE-2026-55228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55228 being exploited in the wild.

How severe is CVE-2026-55228?

High severity, with a CVSS score of 8.1, published 26 August 2026.

Which products and versions are affected?

weblate (PyPI) < 2026.7, ECOSYSTEM:introduced=0,fixed=2026.7.

Is there a fix for CVE-2026-55228?

Yes. weblate (PyPI): upgrade to 2026.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55228 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55228?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55228: Weblate IDOR in GroupViewSet authorization bypass

Q: Which products and versions are affected?

weblate (PyPI) < 2026.7, ECOSYSTEM:introduced=0,fixed=2026.7.

Q: Is there a fix for CVE-2026-55228?

Yes. weblate (PyPI): upgrade to 2026.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55228 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55228?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55228 · Severity: high · CVSS 8.1 · Published 2026-08-26

Weblate is a web-based translation management platform. An insecure direct object reference (IDOR) vulnerability in the GroupViewSet API endpoint allows an authenticated project manager to bypass access controls and view or modify private translation projects they should not have permission to access. This could lead to unauthorized access to sensitive translation data and project configurations.

Technologies: weblate (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55228 being exploited in the wild.
How severe is CVE-2026-55228?: High severity, with a CVSS score of 8.1, published 26 August 2026.
Which products and versions are affected?: weblate (PyPI) < 2026.7, ECOSYSTEM:introduced=0,fixed=2026.7.
Is there a fix for CVE-2026-55228?: Yes. weblate (PyPI): upgrade to 2026.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55228 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55228?: Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weblate (PyPI): upgrade to 2026.7 or later
```
pip install "weblate>=2026.7"
```

Technical details

The vulnerability is an insecure direct object reference (IDOR) flaw classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The GroupViewSet API endpoint fails to properly validate project- and workspace-scoped team access controls, allowing authenticated users with project manager privileges to modify team configurations and grant themselves access to private projects they do not have authorization to view or edit. The attack requires prior authentication but no additional user interaction. An attacker can exploit this to read and modify data in any private project, compromising project confidentiality and integrity. A patch is available in version 2026.7, released via PR #19970.

Affected products

WeblateOrg Weblate < 2026.7

Identifiers

CVE-2026-55228
GHSA-2q2q-jr9g-v9rf
PYSEC-2026-3942

Timeline

2026-07-11: disclosed
2026-07-11: patched: Fixed in version 2026.7
2026-08-28: advisory: Published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.