Description
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WeblateOrg | weblate | < 5.16.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | weblate | 5.16.1-1.1 | openSUSE-SU-2026:10309-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | weblate | < 5.16.1 | 5.16.1 | GHSA-wppc-7cq7-cgfv |
Advisories 1
- openSUSE-SU-2026:10309-1 weblate-5.16.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 8, 2026
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-wppc-7cq7-cgfv
- https://github.com/WeblateOrg/weblate/pull/18107
- https://github.com/WeblateOrg/weblate/pull/18164
- https://github.com/WeblateOrg/weblate/commit/3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9
- https://github.com/WeblateOrg/weblate/commit/7802c9b121eb407c48d4adddd4f2458fb3efef0f
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.16.1