Executive brief
Weblate is a web-based translation management platform. An authenticated user can change their primary account email address to any unverified email through the REST API. An attacker could exploit this by setting a victim's email address and then accepting team invitations sent to that address, potentially gaining unauthorized access to private projects or team permissions without the intended recipient's knowledge.
Technical details
This vulnerability is an account enumeration and privilege escalation weakness in Weblate's REST API. An authenticated user can send PUT or PATCH requests to /api/users/{username}/ to modify their primary email address to an arbitrary, unverified address. The root cause is the absence of email verification requirements during self-service profile updates. An attacker with valid credentials can chain this with administrator-issued email-based team invitations: by first changing their email to a target recipient's address, they can later accept invitations meant for that address without mailbox access. The attack requires authentication but no user interaction from the target. Weblate fixed this in version 2026.8 by restricting email changes to already-verified addresses. Until patching, administrators can mitigate by blocking API requests to that endpoint at the reverse proxy or using username-based invitations instead.
Affected products
- Weblate Weblate prior to 2026.8
Timeline
- 2026-08-15: disclosed: GitHub Security Advisory published
- 2026-08-26: disclosed: CVE-2026-77508 published
- 2026-08-26: patched: Fix released in Weblate 2026.8