CVE-2026-27457CWE-200CWE-862

Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Medium · published February 26, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-862 · Missing Authorization
Published
2026-02-26T21:56Z
EPSS history
Timeline
  • 26 FEB 21:56Z
    Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
    cvelistv5