CVE-2026-33220 Details
Description
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.
A vulnerability exists in Weblate, a web-based localization tool, in versions prior to 5.17. The issue arises from the translation memory API, which exposed unintended endpoints without proper access control. This flaw could potentially allow unauthorized access to certain data or functionalities. The vulnerability has been addressed in version 5.17. For users unable to update immediately, the CDN add-on, which enables this feature, can be disabled as it is not activated by default.
Users can update to Weblate version 5.17 to address this vulnerability. If an immediate update is not possible, the CDN add-on can be disabled, as it is not enabled by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WeblateOrg/weblate/pull/18516 | [email protected] | Issue TrackingPatch |
| https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mqph-7h49-hqfm | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| weblate weblate | < 5.17 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | Initial Analysis | [email protected] |
| Apr 15, 2026 | New CVE Received | [email protected] |