medium4.3
CVE-2026-27457
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
Impact
### Impact Users were able to obtain add-on configuration via API. ### Patches * https://github.com/WeblateOrg/weblate/pull/18107 * https://github.com/WeblateOrg/weblate/pull/18164 ### References Weblate thanks @lighthousekeeper1212 for responsible disclosure.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | weblate | < 5.16.1 | 5.16.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Weblate | Weblate | before 5.16.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/WeblateOrg/weblate/commit/3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9
- https://github.com/WeblateOrg/weblate/commit/7802c9b121eb407c48d4adddd4f2458fb3efef0f
- https://github.com/WeblateOrg/weblate/pull/18107
- https://github.com/WeblateOrg/weblate/pull/18164
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.16.1
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-wppc-7cq7-cgfv
- https://github.com/advisories/GHSA-wppc-7cq7-cgfv
- https://nvd.nist.gov/vuln/detail/CVE-2026-27457