CVE-2026-77507 WeblateOrg CVE debrief

Who should care

Defenders managing Weblate installations, especially those with private projects or restricted components, should assess exposure and prioritize updating to version 2026.8 or later.

Why it matters

CVE-2026-77507 allows unauthorized access to change-history metadata in Weblate versions prior to 2026.8. Defenders managing Weblate installations should assess exposure, prioritize updating, and restrict access to RSS feeds for sensitive projects and components.

• Defenders need to verify exposure of Weblate installations to unauthorized metadata access.
• Private projects and restricted components may be at risk of metadata exposure.
• Updating to Weblate version 2026.8 or later is necessary to fix the vulnerability.
• Defenders should review and restrict access to RSS feeds for sensitive projects and components.

Technical summary

Weblate versions prior to 2026.8 have a vulnerability in object-scoped RSS feeds, which do not apply proper permission checks. This allows unauthorized users to read change-history metadata from private projects and restricted components. The exposed information can include project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links.

Defensive priority

Defenders should prioritize verifying exposure of Weblate installations to unauthorized metadata access, especially for private projects and restricted components.

Recommended defensive actions

• Verify Weblate installations for exposure to unauthorized metadata access, especially for private projects and restricted components.
• Update Weblate to version 2026.8 or later to fix the vulnerability.
• Review and restrict access to RSS feeds for sensitive projects and components.
• Confirm whether affected Weblate installations exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Weblate versions prior to 2026.8, where object-scoped RSS feeds do not apply proper permission checks, allowing unauthorized access to change-history metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.