CVE-2026-33214: 
Python vulnerability analysis and mitigation

CVE-2026-33214 is an improper access control vulnerability in Weblate, a web-based localization tool, affecting all versions prior to 5.17. The translation memory API exposed unintended endpoints that did not enforce proper authorization checks, allowing low-privileged authenticated users to perform unauthorized write operations. The vulnerability was reported by researcher ggamno via HackerOne and disclosed on April 15, 2026, with a fix released in version 5.17. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Weblate Security Advisory).

The root cause is classified as CWE-862 (Missing Authorization): the MemoryViewSet in Weblate's REST API was based on ModelViewSet rather than ReadOnlyModelViewSet, inadvertently exposing create and update endpoints for translation memory entries without enforcing appropriate access controls. An authenticated attacker with low privileges could send HTTP requests to the /api/memory/ endpoints to create or modify translation memory data that they should not have access to. The fix, implemented in pull request #18513, rebased the viewset on ReadOnlyModelViewSet (while retaining delete support where authorized), removing the unintended write endpoints (Weblate PR #18513, GitHub Advisory).

Successful exploitation allows authenticated users with low privileges to perform unauthorized modifications to translation memory data via the /api/memory/ API endpoints, impacting data integrity. Attackers could alter localization content — such as injecting misleading or malicious translations — without proper authorization. There is no confidentiality or availability impact; the scope is limited to integrity of translation memory data within the affected Weblate instance (Weblate Security Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.011% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability requires valid (low-privileged) credentials to exploit, which further limits the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Authentication: Obtain valid low-privileged credentials for the target Weblate instance (e.g., a standard user account).
2. Identify target endpoint: Locate the translation memory API at /api/memory/ on the vulnerable Weblate instance (versions < 5.17).
3. Send unauthorized write request: Issue an HTTP POST or PUT request to /api/memory/ with a crafted payload to create or modify translation memory entries, using the authenticated session token or API key.
4. Achieve unauthorized modification: The server processes the request without proper authorization checks, allowing the attacker to inject or alter translation memory entries beyond their intended permissions (Weblate Security Advisory, Weblate PR #18513).

• Network: Unexpected HTTP POST, PUT, or PATCH requests to /api/memory/ endpoints from low-privileged user accounts; API calls to translation memory endpoints outside of normal application workflows.
• Logs: Web server or application access logs showing write-method requests (POST/PUT/PATCH/DELETE) to /api/memory/ from accounts that should only have read access; unusual frequency of API calls to memory endpoints.
• Application: Unexpected or unauthorized changes to translation memory entries in the Weblate database; new or modified translation memory records not attributable to authorized users.

Upgrade Weblate to version 5.17 or later, which fixes the issue by restricting the translation memory API to read-only operations for unauthorized users (GitHub Advisory). For organizations unable to update immediately, the recommended workaround is to block all access to the /api/memory/ path at the HTTP server level (e.g., via nginx or Apache configuration), which disables the translation memory API feature entirely until patching can be completed (Weblate Security Advisory).