high · 8.1CVE-2026-55228Aug 28, 2026

CVE-2026-55228: Weblate GroupViewSet IDOR Allows Unauthorized Private Project Access

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A logged-in project manager can trick Weblate's team API into granting themselves read and write access to any private project they should not be able to see, just by editing a group's project list…

PackageWeblate
Ecosystempip
Affected< 2026.7
Fixed in2026.7
CVE-2026-55228: Weblate GroupViewSet IDOR Allows Unauthorized Private Project Access

The problem

Weblate's REST API exposes team (group) management at /api/groups/<id>/. Before 2026.7, the GroupViewSet did not validate whether the requesting user actually had access to every project referenced in a PATCH or PUT body.

An authenticated user holding project-manager rights on any project could supply the numeric ID or URL of a completely separate private project in the projects field. The API accepted the assignment without checking scope, effectively adding the private project to the attacker's team and exposing its translations, repository data, and management actions.

Proof of concept

A working proof-of-concept for CVE-2026-55228 in Weblate, with the exact payload below.

http
PATCH /api/groups/42/ HTTP/1.1
Host: weblate.example.com
Authorization: Token <project_manager_token>
Content-Type: application/json

{
  "projects": [
    "https://weblate.example.com/api/projects/secret-private-project/"
  ]
}

The root cause is CWE-639: Authorization Bypass Through User-Controlled Key. The GroupViewSet serializer accepted a projects list and wrote it directly to the database without checking whether the authenticated user had membership in each referenced project.

The patch (PR #19970, commit 19babc99) added scope-enforcement logic to the group write path: project-scoped and workspace-scoped teams now validate that every project in the submitted list falls within the projects the requesting user is already permitted to manage.

Out-of-scope project references are now rejected before the assignment is saved.

Because no existing ownership check was applied to user-supplied project keys, a manager could enumerate private project slugs (or IDs) and self-assign access, satisfying both the Confidentiality: High and Integrity: High impact scores in the CVSS 8.1 rating.

The fix

Upgrade Weblate to version 2026.7 or later. The fix is in PR #19970 (commit 19babc99b05f2cc299b5090f90f79d8181f25d79), which adds per-project access checks to the GroupViewSet write serializer. No configuration workaround exists for older versions; update is the only remediation.

Reported by H3xV0rT3x, imhego, v01demort, b4nder.

References: [1][2][3][4][5]

Related research