CVE-2025-64725: 
Python vulnerability analysis and mitigation

CVE-2025-64725 is an improper invitation validation vulnerability in Weblate, a web-based localization tool, that allows an authenticated user to accept an invitation intended for a different user. It affects all Weblate versions prior to 5.15 and was disclosed on December 15, 2025, following responsible disclosure by researcher Nahid0x. The vulnerability is classified as CWE-286 (Incorrect User Management). The CVSS v3.1 base score is 9.8 (Critical), though the CVSS v4.0 score is 1.0 (Low), reflecting the significant prerequisite conditions required for exploitation in practice (GitHub Advisory).

The root cause is that invitation validation in weblate/auth/views.py was only performed during the HTTP GET request (when the invitation page is loaded) but not during the HTTP POST request (when the invitation is actually accepted). This asymmetry meant that an attacker who obtained an invitation URL could submit a POST request to accept the invitation even if they were not the intended recipient. The fix, merged in PR #16913, refactored the validation logic into a shared validate_invitation() method called by both get() and post() handlers, ensuring consistent enforcement (GitHub PR, Patch Commit).

Successful exploitation allows an attacker to accept a project or organization invitation intended for another user, thereby gaining unauthorized access to Weblate projects or resources that they should not have access to. This compromises the integrity of the user invitation and access management process, potentially exposing sensitive localization data, translation memories, or project configurations to unauthorized parties. The impact is primarily on access control integrity; there is no direct availability impact (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.013%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have access to an invitation URL (e.g., by intercepting or observing a link) and an active Weblate session, limiting the practical attack surface.

1. Obtain an invitation URL: The attacker acquires a valid Weblate invitation link intended for another user — for example, by intercepting an email, observing a shared link, or social engineering.
2. Open the invitation page (GET): The attacker navigates to the invitation URL while authenticated as themselves. In vulnerable versions, the GET handler validates the user but the POST handler does not.
3. Submit the acceptance POST request: The attacker submits an HTTP POST request to the invitation acceptance endpoint (e.g., by manipulating the form submission or crafting a direct POST request), bypassing the user validation that only existed in the GET handler.
4. Gain unauthorized access: The invitation is accepted under the attacker's account, granting them membership or permissions in the target Weblate project or organization that were intended for the legitimate invitee (GitHub PR, GitHub Advisory).

• Logs: Weblate application logs showing a POST request to an invitation acceptance endpoint from a user account that does not match the invitation's intended recipient email or user ID.
• Logs: Audit log entries showing a user being added to a project or organization without a corresponding invitation acceptance by the correct user.
• Application Events: Unexpected new project memberships or role assignments for users who were not the original invitation targets, particularly if the invitation email address differs from the accepting user's registered email.

Upgrade Weblate to version 5.15 or later, which contains the patch that adds invitation validation to the POST handler (Weblate 5.15 Release). As a temporary workaround for those unable to upgrade immediately, avoid leaving Weblate browser sessions open and unattended while an invitation page is loaded, and ensure invitation links are distributed only through secure, private channels (GitHub Advisory). Administrators should also review recent project membership changes for any unexpected additions.

The vulnerability was responsibly disclosed by researcher Nahid0x and acknowledged by the Weblate maintainers. The advisory was published simultaneously with the Weblate 5.15 release on December 15, 2025. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking and aggregation sites (GitHub Advisory).