CVE-2025-67715CWE-284CWE-285broken-access-control

CVE-2025-67715

Medium · published December 16, 2025

CVSS v3.1

4.3

EPSS

Percentile

18.6

In the wild

Unconfirmed

What it is

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00272 · 18.6th percentile
Weaknesses: CWE-284 · Improper Access Control; CWE-285 · Improper Authorization
Published: 2025-12-16T06:15Z

Affected products (1)

Product	Versions	Fixed in
weblate/weblate	< 5.15	5.15

References (2)

https://github.com/WeblateOrg/weblate/pull/17256 · [email protected]https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3pmh-24wp-xpf4 · [email protected]

EPSS history

Timeline

16 DEC 00:07Z
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
cvelistv5