LOW 3.1
GHSA-vj45-x3pj-f4w4
Weblate: Improper access control for pending tasks in API
Details
### Impact The API for tasks didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope.
### Patches * https://github.com/WeblateOrg/weblate/pull/18515
### Workarounds The attacker needs to guess the random UUID of the task, so exploiting this is unlikely with the default API rate limits.
### References This issue was identified by Michal Čihař.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vj45-x3pj-f4w4 [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-33212 [ADVISORY]
- https://github.com/WeblateOrg/weblate/pull/18515 [WEB]
- https://github.com/WeblateOrg/weblate/commit/4e06b12cd05d087db68384e09d5f70fe883f2b70 [WEB]
- https://github.com/WeblateOrg/weblate [PACKAGE]