low3.5
CVE-2026-77508
Weblate is a web based localization tool.
Impact
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.
Affected products
| Product | Affected versions |
|---|---|
| Weblate Is A Web Based Localization Tool. | before 2026.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.