CVE-2026-21889

Exposed in Translation: Weblate Static Asset Bypass

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 14, 2026·6 min read·2 visits

Executive Summary (TL;DR)

Weblate, a popular localization tool, relied on the web server (Nginx/Apache) to serve media files directly for performance. This created a bypass where private screenshots were served as public static assets, completely ignoring application-level permissions. An attacker who can guess or discover the filename of a screenshot can view it without authentication. The fix involves moving media serving back into the application layer.

A classic architectural disconnect between the web server and the application logic allows unauthenticated users to access private project screenshots in Weblate by bypassing Django's access controls entirely.

Official Patches

WeblatePull Request #17516: Enforce permission checks on screenshots

Fix Analysis (1)

Technical Appendix

CVSS Score
2.3/ 10
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Affected Systems

Weblate < 5.15.2

Affected Versions Detail

Product
Affected Versions
Fixed Version
Weblate
WeblateOrg
< 5.15.25.15.2
AttributeDetail
CWECWE-284 (Improper Access Control)
CVSS v4.02.3 (Low)
Attack VectorNetwork
Attack ComplexityHigh (Requires guessing filenames)
PrivilegesNone / Low
StatusPatched

MITRE ATT&CK Mapping

T1596Search Open Technical Databases
Reconnaissance
T1213Data from Information Repositories
Collection
CWE-284
Improper Access Control

The product does not properly restrict access to a resource from an unauthorized actor.

Vulnerability Timeline

Fix committed to main branch
2026-01-06
CVE Published
2026-01-14

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.