CVE-2026-33212 WeblateOrg CVE debrief

Who should care

Defenders responsible for Weblate deployments should assess exposure and verify version 5.17 or later is deployed. Defenders should prioritize verifying Weblate version 5.17 or later and restricting access to the tasks API. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-33212 is a low-severity vulnerability in Weblate that allows unauthorized access to logs of in-progress operations for pending tasks. Defenders should verify Weblate version 5.17 or later is deployed and restrict access to the tasks API.

• Verify Weblate version 5.17 or later is deployed to prevent unauthorized access
• Restrict access to the tasks API to minimize exposure

Technical summary

The tasks API in Weblate versions prior to 5.17 did not verify user access for pending tasks, potentially exposing logs of in-progress operations to unauthorized users. The vulnerability requires brute-forcing the random UUID of the task, making exploitation unlikely with default API rate limits. This issue has been fixed in version 5.17, and defenders should verify Weblate version 5.17 or later is deployed and restrict access to the tasks API. The vulnerability allows unauthorized access to logs of in-progress operations for pending tasks via the tasks API.

Defensive priority

Defenders should prioritize verifying Weblate version 5.17 or later and restricting access to the tasks API.

Recommended defensive actions

• Verify Weblate version 5.17 or later is deployed
• Restrict access to the tasks API
• Monitor API usage for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in Weblate version 5.17. The tasks API in Weblate versions prior to 5.17 did not verify user access for pending tasks, potentially exposing logs of in-progress operations to unauthorized users. The CVE Program record and NVD entry provide source-provided CVE metadata and official NIST NVD detail page and source-specific vulnerability assessment respectively.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.