Executive brief
Weblate is a web-based platform for managing software translations across projects and components. The RSS feeds for tracking changes did not properly check user permissions, allowing unauthorized users—including anonymous visitors on public installations—to view metadata about changes in private projects and restricted components. The exposed information includes project names, contributor details, and timestamps, potentially revealing internal development activity.
Technical details
Weblate's object-scoped RSS feeds at /exports/rss/ lacked permission checks that were applied elsewhere in the API, resulting in an authorization bypass (CWE-862, CWE-863). The vulnerability allows any network-accessible attacker to retrieve change-history metadata from private projects and restricted components without authentication. The exposed metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and links to translations or units, though actual translated string content is not included. The fix applies Weblate's standard permission-aware filtering to RSS feeds and is available in version 2026.8.
Affected products
- Weblate Weblate prior to 2026.8
Timeline
- 2026-08-15: disclosed
- 2026-08-26: patched