Is CVE-2026-77508 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77508 being exploited in the wild.

How severe is CVE-2026-77508?

Low severity, with a CVSS score of 3.5, published 26 August 2026.

Which products and versions are affected?

Weblate Weblate prior to 2026.8.

Is there a fix for CVE-2026-77508?

A patch was published on 2026-08-26: Fix released in Weblate 2026.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77508 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-77508?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77508: Weblate unverified email change in REST API

CVE-2026-77508 · Severity: low · CVSS 3.5 · Published 2026-08-26

Weblate is a web-based translation management platform. An authenticated user can change their primary account email address to any unverified email through the REST API. An attacker could exploit this by setting a victim's email address and then accepting team invitations sent to that address, potentially gaining unauthorized access to private projects or team permissions without the intended recipient's knowledge.

Quick answers

Is CVE-2026-77508 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77508 being exploited in the wild.
How severe is CVE-2026-77508?: Low severity, with a CVSS score of 3.5, published 26 August 2026.
Which products and versions are affected?: Weblate Weblate prior to 2026.8.
Is there a fix for CVE-2026-77508?: A patch was published on 2026-08-26: Fix released in Weblate 2026.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77508 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-77508?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an account enumeration and privilege escalation weakness in Weblate's REST API. An authenticated user can send PUT or PATCH requests to /api/users/{username}/ to modify their primary email address to an arbitrary, unverified address. The root cause is the absence of email verification requirements during self-service profile updates. An attacker with valid credentials can chain this with administrator-issued email-based team invitations: by first changing their email to a target recipient's address, they can later accept invitations meant for that address without mailbox access. The attack requires authentication but no user interaction from the target. Weblate fixed this in version 2026.8 by restricting email changes to already-verified addresses. Until patching, administrators can mitigate by blocking API requests to that endpoint at the reverse proxy or using username-based invitations instead.

Affected products

Weblate Weblate prior to 2026.8

Timeline

2026-08-15: disclosed: GitHub Security Advisory published
2026-08-26: disclosed: CVE-2026-77508 published
2026-08-26: patched: Fix released in Weblate 2026.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.