Skip to content
OpenAdvisories
Medium · 4.3 CVE-2025-67715 EUVD-2025-203447GHSA-3pmh-24wp-xpf4PYSEC-2025-233

Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

Published Dec 16, 2025 · Updated Dec 16, 2025 · Assigned by GitHub_M

Description

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

Affected products

VendorProductAffectedFixed
WeblateOrg weblate < 5.15 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI weblate < 5.15 5.15 GHSA-3pmh-24wp-xpf4

References