IDOR Vulnerability in Weblate GroupViewSet API

Weblate, an open-source translation tool, is affected by a security vulnerability (CVE-2026-55228) in the GroupViewSet API. This Insecure Direct Object Reference (IDOR) flaw permits an authenticated user with project manager privileges to bypass existing authorization controls. By submitting requests that manipulate project- and workspace-scoped team configurations, attackers can misconfigure project access rights. This action results in unauthorized read access to private projects that the user would otherwise be restricted from viewing. The vulnerability affects all versions of Weblate prior to 2026.7. Defenders should prioritize patching, as this vulnerability allows for the unauthorized exfiltration of sensitive translation project data within multi-tenant or multi-project environments.

Impact

Successful exploitation grants unauthorized read access to sensitive private projects. In environments where multiple teams share a Weblate instance, this allows project managers to potentially view proprietary intellectual property or sensitive documentation stored within private translation projects. No estimate of victim count is provided, but the vulnerability impacts all organizations self-hosting Weblate versions below 2026.7.

Recommendation

• Upgrade all Weblate instances to version 2026.7 or later to resolve the underlying API logic flaw in GroupViewSet.
• Review audit logs for unusual API requests directed at the GroupViewSet endpoints that involve project-scoped team modifications.
• Restrict project manager privileges to trusted users until patches can be applied to minimize the window of opportunity for privilege abuse.