CVE-2026-55228

highpriority · track · 0EPSS 0.004 · 39 %ileUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.45% (39th) EPSS
CVSS 8.1 · high
Is it mine?
1 products
Check your exposure
Who says so?
1 sources
osv

EPSS · scored 2026-10-27

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.

01

cvss

Technical severity, 0–10. One row per scoring source.

8.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · security-advisories@github.comexploitability 2.8 · impact 5.2
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV
v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-639USCWE-639US
04

affected products (1)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • GHSA-2q2q-jr9g-v9rfWeblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project2026-08-28ghsa · osvUS

    ### Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. ### Patches * https://github.com/WeblateOrg/weblate/pull/19970 ### References Parts of this issue were independently reported by four reporters: * @H3xV0rT3x via GitHub * [imhego](https://hackerone.com/imhego) via HackerOne * [v01demort](https://hackerone.com/v01demort) via HackerOne * [b4nder](https://hackerone.com/b4nder) via HackerOne

  • PYSEC-2026-3942Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project2026-09-10vendor · osvUS

    ### Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to. ### Patches * https://github.com/WeblateOrg/weblate/pull/19970 ### References Parts of this issue were independently reported by four reporters: * @H3xV0rT3x via GitHub * [imhego](https://hackerone.com/imhego) via HackerOne * [v01demort](https://hackerone.com/v01demort) via HackerOne * [b4nder](https://hackerone.com/b4nder) via HackerOne

06

also known as (2)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

osvNVDCVE.orgMITRE
published 2026-08-26modified 2026-08-27
08

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan