CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.

CVSS v3 2.3 LOW

2.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.6 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/WeblateOrg/wlc/commit/15cbdfc5b2c6183ef6864ea758091643a0ce6c89
https://github.com/WeblateOrg/wlc/pull/1500
https://github.com/WeblateOrg/wlc/releases/tag/2.0.1
https://github.com/WeblateOrg/wlc/security/advisories/GHSA-3mqq-hv9c-85hc

Configurations

No configuration.

History

22 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-22 21:17

Updated : 2026-09-26 01:17

NVD link : CVE-2026-62364

Mitre link : CVE-2026-62364

CVE.ORG link : CVE-2026-62364

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-349

Acceptance of Extraneous Untrusted Data With Trusted Data

{"id": "CVE-2026-62364", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62364", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-26T00:10:08.812343Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 2.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WeblateOrg", "product": "wlc", "versions": [{"status": "affected", "version": "< 2.0.1"}]}]}], "published": "2026-09-22T21:17:30.743", "references": [{"url": "https://github.com/WeblateOrg/wlc/commit/15cbdfc5b2c6183ef6864ea758091643a0ce6c89", "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/wlc/pull/1500", "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/wlc/releases/tag/2.0.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-3mqq-hv9c-85hc", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-349"}]}], "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1."}], "lastModified": "2026-09-26T01:17:01.403", "sourceIdentifier": "security-advisories@github.com"}