CVE-2026-27457: 
Python vulnerability analysis and mitigation

CVE-2026-27457 is a missing authorization vulnerability in Weblate, a web-based localization tool, that allows authenticated (or anonymous) users to enumerate and retrieve all addon configurations across all projects and components via the REST API. The flaw affects all Weblate versions prior to 5.16.1 and was disclosed on February 26, 2026, following responsible disclosure by researcher @lighthousekeeper1212. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is a missing authorization check (CWE-862) combined with information exposure (CWE-200) in the AddonViewSet class within weblate/api/views.py. Specifically, the viewset used queryset = Addon.objects.all() without overriding get_queryset() to scope results by the requesting user's permissions, meaning any authenticated user could issue GET /api/addons/ or GET /api/addons/{id}/ to list and retrieve all addon configurations platform-wide. The fix introduced a proper get_queryset() override that filters addons to only those belonging to projects the user manages (managed_projects), and further restricts access to project admins to align with the UI behavior, since addon configurations may contain sensitive information (GitHub PR #18107, GitHub PR #18164, Commit 3f58f9a).

Successful exploitation allows any authenticated user — or anonymous users on instances where REQUIRE_LOGIN is not enforced — to read addon configurations for all projects and components, including those belonging to private or restricted projects. Addon configurations may contain sensitive settings such as API keys, integration credentials, or internal workflow parameters. The impact is limited to confidentiality (no integrity or availability impact), but exposure of such configurations could facilitate further attacks or reconnaissance against integrated systems (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid user account (low privileges) and network access to the Weblate API, making it trivially easy to attempt once an attacker has any level of access (GitHub Advisory, Feedly).

1. Obtain credentials: Acquire any valid Weblate user account, or identify instances where REQUIRE_LOGIN is disabled (allowing anonymous access).
2. Authenticate to the API: Use the Weblate REST API with the obtained credentials, e.g., via an API token in the Authorization: Token <token> header.
3. Enumerate all addons: Send a GET /api/addons/ request to list all addon configurations across all projects and components, regardless of project visibility or user permissions.
4. Retrieve specific addon details: Use GET /api/addons/{id}/ to fetch the full configuration of any specific addon, potentially exposing sensitive settings such as integration credentials or API keys.
5. Leverage exposed data: Use any sensitive information found in addon configurations (e.g., third-party API keys, webhook secrets) for further attacks against integrated systems (GitHub Advisory, Commit 3f58f9a).

• Network: Unusual or repeated GET requests to /api/addons/ or /api/addons/{id}/ from user accounts that are not project administrators or superusers; bulk enumeration of addon IDs in API access logs.
• Logs: Weblate API access logs showing authenticated (or anonymous) users accessing the addon listing endpoint across multiple projects they do not administer; high volume of sequential addon ID lookups from a single user or IP address.
• Behavioral: Non-admin users or service accounts querying addon endpoints that they would not normally access as part of their workflow.

Upgrade Weblate to version 5.16.1 or later, which introduces a proper get_queryset() override in AddonViewSet that restricts addon listings to projects the user manages and limits detailed access to project administrators (GitHub Advisory, Commit 7802c9b). As an interim measure, enabling REQUIRE_LOGIN prevents anonymous access to the API. There is no known configuration-only workaround that fully mitigates the issue for authenticated users without upgrading.

The vulnerability was responsibly disclosed by @lighthousekeeper1212 and acknowledged by the Weblate maintainer (nijel), who issued two patch PRs within days of the report. The advisory was picked up by standard vulnerability aggregators including Red Hat, openSUSE, and ENISA's EUVD shortly after disclosure, reflecting routine tracking of the moderate-severity issue. No significant broader media coverage or notable researcher commentary beyond the standard advisory cycle has been observed (GitHub Advisory, Red Hat).