Summary
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
Advisory details
Impact
The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404.
Patches
References
Thanks to Yaohui Wang for reporting this via GitHub.
References
- https://github.com/advisories/GHSA-2p9g-x3cv-5hh4
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2p9g-x3cv-5hh4
- https://nvd.nist.gov/vuln/detail/CVE-2026-55227
- https://github.com/WeblateOrg/weblate/pull/19971
- https://github.com/WeblateOrg/weblate/commit/836bc082803d49d02f2831ec8339268eb66bcdae
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.7
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-105675
Ghost: Invite Token Disclosure in Ghost Admin API
- MEDIUMCVE-2026-106506
Backstage has improper input validation in scaffolder task list ordering
- HIGHCVE-2026-96627
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
- MEDIUMCVE-2026-96628
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
- CRITICALCVE-2026-105192
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
- HIGHCVE-2026-100349
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content