CVE-2025-64326CWE-212

Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log

Low · published November 6, 2025

CVSS v3.1
2.6
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00199 · 9.2th percentile
Weakness
CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer
Published
2025-11-06T20:55Z
EPSS history
Timeline
  • 06 NOV 20:55Z
    Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log
    cvelistv5