Weblate has improper validation upon invitation acceptance
### Impact It was possible to accept an invitation opened by a different Weblate user. ### Patches * https://github.com/WeblateOrg/weblate/pull/16913 ### Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. ### References Thanks to Nahid0x for responsibly disclosing this vulnerability to Weblate.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-64725US | critical9.8 | — | ||
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workar… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/WeblateOrg/weblatePACKAGE
- https://github.com/WeblateOrg/weblate/commit/02e904675f0608a6bbfbf9466eeccd9d022591e9WEB
- https://github.com/WeblateOrg/weblate/pull/16913WEB
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15WEB
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-m6hq-f4w9-qrjjWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-64725ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan