# CVE-2026-62249: Weblate improper authorization in nested API change endpoints

Source: https://junglewise.ai/threats/cve-2026-62249-weblate-improper-authorization-in-nested-api-change-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62249 · Severity: medium · CVSS 4.3 · Published 2026-08-26

Weblate is a web-based platform that manages software translations across teams and projects. An authenticated user with access to a project can view the change history of restricted (hidden) components through API endpoints, exposing sensitive translation data including source strings and modifications that should have been hidden from them. This allows data leakage to users who should not have visibility into certain components.

## Quick answers

**Is CVE-2026-62249 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62249 being exploited in the wild.

**How severe is CVE-2026-62249?** Medium severity, with a CVSS score of 4.3, published 26 August 2026.

**Which products and versions are affected?** Weblate Weblate prior to 2026.7.

**Is there a fix for CVE-2026-62249?** A patch was published on 2026-07: Fixed in version 2026.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62249 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62249?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authorization issue (CWE-285) in Weblate's REST API where nested change endpoints (`GET /api/projects/{slug}/changes/`) fail to enforce component-level access controls. While direct component views apply permission checks, the nested endpoints bypass these controls, allowing an authenticated user to enumerate and retrieve change history for restricted components within a project they have access to. The exposed payload includes component identity, translation/unit links, and sensitive fields such as source and translated string content. The vulnerability requires authentication and project-level access, but no additional user interaction. This was patched in version 2026.7 by routing nested change endpoints through a permission-aware change queryset.

## Affected products

- Weblate Weblate prior to 2026.7

## Timeline

- 2026-08-26: disclosed
- 2026-07: patched: Fixed in version 2026.7

## References

- [https://github.com/WeblateOrg/weblate/commit/a27b02110ab33995bce8cf9ea0eeddf72aa334ca](https://github.com/WeblateOrg/weblate/commit/a27b02110ab33995bce8cf9ea0eeddf72aa334ca)
- [https://github.com/WeblateOrg/weblate/security/advisories/GHSA-92m8-wv36-prmx](https://github.com/WeblateOrg/weblate/security/advisories/GHSA-92m8-wv36-prmx)