Skip to content
OpenAdvisories
High · 8.8 CVE-2026-34393 EUVD-2026-23005GHSA-3382-gw9x-477vPYSEC-2026-155

Weblate: Privilege escalation in the user API endpoint

Published Apr 15, 2026 · Updated Apr 15, 2026 · Assigned by GitHub_M

Description

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

Affected products

VendorProductAffectedFixed
WeblateOrg weblate < 5.17 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI weblate < 5.17 5.17 GHSA-3382-gw9x-477v

References