CVE-2026-27457

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27457
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/WeblateOrg/weblate/commit/3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9 Patch
https://github.com/WeblateOrg/weblate/commit/7802c9b121eb407c48d4adddd4f2458fb3efef0f Patch
https://github.com/WeblateOrg/weblate/pull/18107 Issue Tracking Patch
https://github.com/WeblateOrg/weblate/pull/18164 Issue Tracking Patch
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.16.1 Product Release Notes
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-wppc-7cq7-cgfv Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*
History

27 Feb 2026, 17:05

Type Values Removed Values Added
References () https://github.com/WeblateOrg/weblate/commit/3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9 - () https://github.com/WeblateOrg/weblate/commit/3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9 - Patch
References () https://github.com/WeblateOrg/weblate/commit/7802c9b121eb407c48d4adddd4f2458fb3efef0f - () https://github.com/WeblateOrg/weblate/commit/7802c9b121eb407c48d4adddd4f2458fb3efef0f - Patch
References () https://github.com/WeblateOrg/weblate/pull/18107 - () https://github.com/WeblateOrg/weblate/pull/18107 - Issue Tracking, Patch
References () https://github.com/WeblateOrg/weblate/pull/18164 - () https://github.com/WeblateOrg/weblate/pull/18164 - Issue Tracking, Patch
References () https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.16.1 - () https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.16.1 - Product, Release Notes
References () https://github.com/WeblateOrg/weblate/security/advisories/GHSA-wppc-7cq7-cgfv - () https://github.com/WeblateOrg/weblate/security/advisories/GHSA-wppc-7cq7-cgfv - Patch, Vendor Advisory
CPE cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*
First Time Weblate
Weblate weblate

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Weblate es una herramienta de localización basada en web. Antes de la versión 5.16.1, el `AddonViewSet` de la API REST (`weblate/api/views.py`, línea 2831) utiliza `queryset = Addon.objects.all()` sin sobrescribir `get_queryset()` para limitar el alcance de los resultados por permisos de usuario. Esto permite a cualquier usuario autenticado (o usuarios anónimos si `REQUIRE_LOGIN` no está configurado) listar y recuperar TODOS los complementos en todos los proyectos y componentes a través de `GET /api/addons/` y `GET /api/addons/{id}/`. La versión 5.16.1 soluciona el problema.

26 Feb 2026, 22:20

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-26 22:20

Updated : 2026-02-27 17:05

NVD link : CVE-2026-27457

Mitre link : CVE-2026-27457

CVE.ORG link : CVE-2026-27457

JSON object : View

Products Affected

weblate

  • weblate
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-862

Missing Authorization