Summary
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
Advisory details
Impact
The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404.
Patches
References
Thanks to Yaohui Wang for reporting this via GitHub.
References
- https://github.com/advisories/GHSA-2p9g-x3cv-5hh4
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2p9g-x3cv-5hh4
- https://nvd.nist.gov/vuln/detail/CVE-2026-55227
- https://github.com/WeblateOrg/weblate/pull/19971
- https://github.com/WeblateOrg/weblate/commit/836bc082803d49d02f2831ec8339268eb66bcdae
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.7
Related vulnerabilities
All Supply chain →- HIGHGHSA-7q9c-hpx7-9cwm
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
- CRITICALCVE-2026-73842
OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
- MEDIUMCVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
- MEDIUMCVE-2026-73556
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
- MEDIUMCVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
- MEDIUMCVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds