CVE-2026-41519

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/WeblateOrg/weblate/commit/649a2da81700542f95c0807b3c625fc3bb0eaf95	Patch
https://github.com/WeblateOrg/weblate/pull/19057	Issue Tracking Patch
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1	Release Notes
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6j8j-4qp3-36p2	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Weblate es una herramienta de localización basada en web. Antes de la versión 5.17.1, cuando un usuario cambia su contraseña, las sesiones del navegador son correctamente invalidadas a través de ’cycle_session_keys()’, pero los tokens de la API de DRF (prefijo ’wlu_*’) almacenados en ’authtoken_token’ no son revocados. Este problema ha sido parcheado en la versión 5.17.1.

Information

Published : 2026-05-07 15:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-41519

Mitre link : CVE-2026-41519

CVE.ORG link : CVE-2026-41519

JSON object : View

Products Affected

weblate

weblate

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-41519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41519", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T14:45:16.394304Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WeblateOrg", "product": "weblate", "versions": [{"status": "affected", "version": "< 5.17.1"}]}]}], "published": "2026-05-07T15:16:07.160", "references": [{"url": "https://github.com/WeblateOrg/weblate/commit/649a2da81700542f95c0807b3c625fc3bb0eaf95", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/weblate/pull/19057", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6j8j-4qp3-36p2", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via \"cycle_session_keys()\", but DRF API tokens (\"wlu_*\" prefix) stored in \"authtoken_token\" are not revoked. This issue has been patched in version 5.17.1."}, {"lang": "es", "value": "Weblate es una herramienta de localizaci\u00f3n basada en web. Antes de la versi\u00f3n 5.17.1, cuando un usuario cambia su contrase\u00f1a, las sesiones del navegador son correctamente invalidadas a trav\u00e9s de \u2019cycle_session_keys()\u2019, pero los tokens de la API de DRF (prefijo \u2019wlu_*\u2019) almacenados en \u2019authtoken_token\u2019 no son revocados. Este problema ha sido parcheado en la versi\u00f3n 5.17.1."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "883115A9-8BF0-460B-B711-BDC6C4FCBE10", "versionEndExcluding": "5.17.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}