Executive brief
Weblate is a web-based platform that manages software translations across teams and projects. An authenticated user with access to a project can view the change history of restricted (hidden) components through API endpoints, exposing sensitive translation data including source strings and modifications that should have been hidden from them. This allows data leakage to users who should not have visibility into certain components.
Technical details
The vulnerability is an improper authorization issue (CWE-285) in Weblate's REST API where nested change endpoints (`GET /api/projects/{slug}/changes/`) fail to enforce component-level access controls. While direct component views apply permission checks, the nested endpoints bypass these controls, allowing an authenticated user to enumerate and retrieve change history for restricted components within a project they have access to. The exposed payload includes component identity, translation/unit links, and sensitive fields such as source and translated string content. The vulnerability requires authentication and project-level access, but no additional user interaction. This was patched in version 2026.7 by routing nested change endpoints through a permission-aware change queryset.
Affected products
- Weblate Weblate prior to 2026.7
Timeline
- 2026-08-26: disclosed
- 2026-07: patched: Fixed in version 2026.7