weblateorg/weblate · Security
Weblate leaks information via screenshots
- GHSA ID
- GHSA-3g2f-4rjg-9385
- CVE ID
- CVE-2026-21889
- Severity
- low
- Published
- Updated
- CVSS v4
- 2.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Description
Impact
The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.
Patches
References
Thanks to Lukas May and Michael Leu for reporting this.
CWEs
- CWE-284 · Improper Access Control
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385 ↗
- https://github.com/WeblateOrg/weblate/pull/17516 ↗
- https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-21889 ↗
- https://github.com/advisories/GHSA-3g2f-4rjg-9385 ↗