Résumé
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
Détails de l’avis
Impact
The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.
Patches
References
Parts of this issue were independently reported by four reporters:
Références
- https://github.com/advisories/GHSA-2q2q-jr9g-v9rf
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2q2q-jr9g-v9rf
- https://nvd.nist.gov/vuln/detail/CVE-2026-55228
- https://github.com/WeblateOrg/weblate/pull/19970
- https://github.com/WeblateOrg/weblate/commit/19babc99b05f2cc299b5090f90f79d8181f25d79
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-107850
Contao: Improper access control in the preview links module
- MEDIUMCVE-2026-91980
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
- MEDIUMCVE-2026-91984
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
- HIGHCVE-2026-91985
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
- HIGHCVE-2026-76216
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
- CRITICALCVE-2026-68582
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)