GHSA-2q2q-jr9g-v9rf
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
Quick fix
GHSA-2q2q-jr9g-v9rf — weblate: upgrade to the fixed version with the command below.
pip install --upgrade 'weblate>=2026.7'Details
### Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.
### Patches * https://github.com/WeblateOrg/weblate/pull/19970
### References
Parts of this issue were independently reported by four reporters: * @H3xV0rT3x via GitHub * [imhego](https://hackerone.com/imhego) via HackerOne * [v01demort](https://hackerone.com/v01demort) via HackerOne * [b4nder](https://hackerone.com/b4nder) via HackerOne
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2q2q-jr9g-v9rf[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-55228[ADVISORY]
- https://github.com/WeblateOrg/weblate/pull/19970[WEB]
- https://github.com/WeblateOrg/weblate/commit/19babc99b05f2cc299b5090f90f79d8181f25d79[WEB]
- https://github.com/WeblateOrg/weblate[PACKAGE]