# CVE-2026-77507: Weblate RSS feed authorization bypass

Source: https://junglewise.ai/threats/cve-2026-77507-weblate-rss-feed-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77507 · Severity: medium · CVSS 5.3 · Published 2026-08-26

Weblate is a web-based platform for managing software translations across projects and components. The RSS feeds for tracking changes did not properly check user permissions, allowing unauthorized users—including anonymous visitors on public installations—to view metadata about changes in private projects and restricted components. The exposed information includes project names, contributor details, and timestamps, potentially revealing internal development activity.

## Quick answers

**Is CVE-2026-77507 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77507 being exploited in the wild.

**How severe is CVE-2026-77507?** Medium severity, with a CVSS score of 5.3, published 26 August 2026.

**Which products and versions are affected?** Weblate Weblate prior to 2026.8.

**Is there a fix for CVE-2026-77507?** A patch was published on 2026-08-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77507 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77507?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Weblate's object-scoped RSS feeds at /exports/rss/ lacked permission checks that were applied elsewhere in the API, resulting in an authorization bypass (CWE-862, CWE-863). The vulnerability allows any network-accessible attacker to retrieve change-history metadata from private projects and restricted components without authentication. The exposed metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and links to translations or units, though actual translated string content is not included. The fix applies Weblate's standard permission-aware filtering to RSS feeds and is available in version 2026.8.

## Affected products

- Weblate Weblate prior to 2026.8

## Timeline

- 2026-08-15: disclosed
- 2026-08-26: patched

## References

- [https://github.com/WeblateOrg/weblate/commit/9bcccfd3a38eea6ebffce582222cd5eac3aa3642](https://github.com/WeblateOrg/weblate/commit/9bcccfd3a38eea6ebffce582222cd5eac3aa3642)
- [https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vvc6-wvqm-w5gc](https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vvc6-wvqm-w5gc)