CVE-2026-27457
Weblate is a web based localization tool.
Published Feb 26, 2026 · updated Jun 17, 2026 · weblate weblate
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's ( , line 2831) uses without overriding to scope results by user permissions. This allows any authenticated user (or anonymous users if is not set) to list and retrieve ALL addons across all projects and components via and . Version 5.16.1 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 26, 2026 · NIST NVD
Detected
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's ( , line 2831) uses without overriding to scope results by user permissions. This allows any authenticated user (or anonymous users if is not set) to list and retrieve ALL addons across all projects and components via and . Version 5.16.1 fixes the issue.
Jun 17, 2026 · NIST NVD
Updated
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's ( , line 2831) uses without overriding to scope results by user permissions. This allows any authenticated user (or anonymous users if is not set) to list and retrieve ALL addons across all projects and components via and . Version 5.16.1 fixes the issue.
Affected
- cpe weblate/weblateversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27457
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27457
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's ( , line 2831) uses without overriding to scope results by user permissions. This allows any authenticated user
nvd.nist.gov