Executive brief
Weblate is a web-based translation management platform used by organizations to coordinate software localization. Teams can enforce two-factor authentication (2FA) to protect sensitive permissions, but this requirement was not being applied to site-wide global permissions. An attacker who is a team member without 2FA configured could still receive and exercise global administrative permissions, including access to the site management interface, undermining the security policy intended by administrators.
Technical details
This is an improper access control vulnerability (CWE-284) where the 2FA enforcement check is missing for global-scope permissions while correctly applied to project-, component-, and workspace-scoped permissions. A team member belonging to a team with the enforced_2fa flag set would normally have their team permissions withheld until 2FA is configured, but this logic was not implemented for site-wide permissions. The vulnerability requires the attacker to be a team member in a team that both enforces 2FA and grants a global permission (high privilege requirement, high attack complexity). An authenticated attacker without 2FA can access /manage/ and other site-wide administrative functions. The issue is fixed in version 2026.7.
Affected products
- Weblate Weblate prior to 2026.7
Timeline
- 2026-07-11: disclosed
- 2026-07-26: patched: Fixed in version 2026.7
- 2026-08-26: advisory