CVE-2026-34393CWE-269

Weblate: Privilege escalation in the user API endpoint

High · published April 15, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00537 · 44.5th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-04-15T18:24Z
EPSS history
Timeline
  • 15 APR 18:24Z
    Weblate: Privilege escalation in the user API endpoint
    cvelistv5