CVE-2026-55228

highPriorität · verfolgen · 0EPSS 0.004 · 39. PerzentilUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.45% (39th) EPSS
CVSS 8.1 · high
Is it mine?
1 products
Prüfe deine Angriffsfläche
Who says so?
1 sources
osv

EPSS · bewertet 2026-10-27

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.

01

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 2.8 · Auswirkung 5.2
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV
v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
02

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-639USCWE-639US
04

betroffene Produkte (1)

Betroffene Produkte und Versionsbereiche.

05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • GHSA-2q2q-jr9g-v9rfWeblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project2026-08-28ghsa · osvUS

    ### Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. ### Patches * https://github.com/WeblateOrg/weblate/pull/19970 ### References Parts of this issue were independently reported by four reporters: * @H3xV0rT3x via GitHub * [imhego](https://hackerone.com/imhego) via HackerOne * [v01demort](https://hackerone.com/v01demort) via HackerOne * [b4nder](https://hackerone.com/b4nder) via HackerOne

  • PYSEC-2026-3942Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project2026-09-10vendor · osvUS

    ### Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. ### Patches * https://github.com/WeblateOrg/weblate/pull/19970 ### References Parts of this issue were independently reported by four reporters: * @H3xV0rT3x via GitHub * [imhego](https://hackerone.com/imhego) via HackerOne * [v01demort](https://hackerone.com/v01demort) via HackerOne * [b4nder](https://hackerone.com/b4nder) via HackerOne

06

auch bekannt als (2)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

osvNVDCVE.orgMITRE
veröffentlicht 2026-08-26geändert 2026-08-27
08

Referenzen (2) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan