CVE-2026-33214

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/WeblateOrg/weblate/pull/18513	Issue Tracking Patch
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mpf5-3vph-q75r	Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Weblate es una herramienta de localización basada en web. En versiones anteriores a la 5.17, la API de memoria de traducción expuso puntos finales no intencionados, lo que a su vez no aplicaba un control de acceso adecuado. Este problema ha sido solucionado en la versión 5.17. Si los usuarios no pueden actualizar inmediatamente, pueden solucionar este problema bloqueando el acceso a /api/memory/ en el servidor HTTP, lo que elimina el acceso a esta característica.

Information

Published : 2026-04-15 18:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33214

Mitre link : CVE-2026-33214

CVE.ORG link : CVE-2026-33214

JSON object : View

Products Affected

weblate

weblate

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-33214", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33214", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T18:31:35.155126Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WeblateOrg", "product": "weblate", "versions": [{"status": "affected", "version": "< 5.17"}]}]}], "published": "2026-04-15T18:17:20.053", "references": [{"url": "https://github.com/WeblateOrg/weblate/pull/18513", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mpf5-3vph-q75r", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature."}, {"lang": "es", "value": "Weblate es una herramienta de localizaci\u00f3n basada en web. En versiones anteriores a la 5.17, la API de memoria de traducci\u00f3n expuso puntos finales no intencionados, lo que a su vez no aplicaba un control de acceso adecuado. Este problema ha sido solucionado en la versi\u00f3n 5.17. Si los usuarios no pueden actualizar inmediatamente, pueden solucionar este problema bloqueando el acceso a /api/memory/ en el servidor HTTP, lo que elimina el acceso a esta caracter\u00edstica."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64AD3B80-D39E-4EAF-9CF8-B4D3C8A6C58A", "versionEndExcluding": "5.17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}