Is CVE-2026-61790 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61790 being exploited in the wild.

How severe is CVE-2026-61790?

Medium severity, with a CVSS score of 4.4, published 26 August 2026.

Which products and versions are affected?

Weblate Weblate prior to 2026.7.

Is there a fix for CVE-2026-61790?

A patch was published on 2026-07-26: Fixed in version 2026.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61790 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61790?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61790: Weblate team-enforced 2FA bypass for global permissions

CVE-2026-61790 · Severity: medium · CVSS 4.4 · Published 2026-08-26

Weblate is a web-based translation management platform used by organizations to coordinate software localization. Teams can enforce two-factor authentication (2FA) to protect sensitive permissions, but this requirement was not being applied to site-wide global permissions. An attacker who is a team member without 2FA configured could still receive and exercise global administrative permissions, including access to the site management interface, undermining the security policy intended by administrators.

Quick answers

Is CVE-2026-61790 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61790 being exploited in the wild.
How severe is CVE-2026-61790?: Medium severity, with a CVSS score of 4.4, published 26 August 2026.
Which products and versions are affected?: Weblate Weblate prior to 2026.7.
Is there a fix for CVE-2026-61790?: A patch was published on 2026-07-26: Fixed in version 2026.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61790 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61790?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an improper access control vulnerability (CWE-284) where the 2FA enforcement check is missing for global-scope permissions while correctly applied to project-, component-, and workspace-scoped permissions. A team member belonging to a team with the enforced_2fa flag set would normally have their team permissions withheld until 2FA is configured, but this logic was not implemented for site-wide permissions. The vulnerability requires the attacker to be a team member in a team that both enforces 2FA and grants a global permission (high privilege requirement, high attack complexity). An authenticated attacker without 2FA can access /manage/ and other site-wide administrative functions. The issue is fixed in version 2026.7.

Affected products

Weblate Weblate prior to 2026.7

Timeline

2026-07-11: disclosed
2026-07-26: patched: Fixed in version 2026.7
2026-08-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.