CVE-2026-77507— Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
Quick assessment
Affected
WeblateOrg weblate
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WeblateOrg weblate是WeblateOrg组织的一款消息队列中间件。 WeblateOrg weblate 2026.8之前版本存在安全漏洞，该漏洞源于对象级RSS订阅未应用权限检查，可能导致未经授权的用户读取私有项目和受限组件的变更历史元数据。
Possible ATT&CK Techniques 1 AI
T1213 · Data from Information RepositoriesAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WeblateOrg | weblate | < 2026.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77507
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
Source: CVE Program / CVE List V5
Vulnerability Description
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations that permit anonymous access, this metadata can be retrieved without any authentication. The exposed information can include project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, though translated-string content is not included in the feed. Installations using private projects or restricted components are affected. This issue is fixed in version 2026.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
WeblateOrg weblate 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WeblateOrg weblate是WeblateOrg组织的一款消息队列中间件。 WeblateOrg weblate 2026.8之前版本存在安全漏洞，该漏洞源于对象级RSS订阅未应用权限检查，可能导致未经授权的用户读取私有项目和受限组件的变更历史元数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WeblateOrg | weblate | < 2026.8 | - |
|
II. Public POCs for CVE-2026-77507
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77507
请登录查看更多情报信息。
Same Patch Batch · WeblateOrg · 2026-08-26 · 9 CVEs total
| CVE-2026-55228 | 8.1 HIGH | Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorize |
| CVE-2026-61792 | 7.7 HIGH | Weblate path traversal allows a project administrator to read arbitrary files via App stor |
| CVE-2026-62326 | 6.5 MEDIUM | Weblate Has Uncontrolled Resource Consumption via |
| CVE-2026-61790 | 4.4 MEDIUM | Weblate: Team-enforced 2FA is bypassed for global permissions |
| CVE-2026-62249 | 4.3 MEDIUM | Weblate: Restricted-component change history leaked to non-member project users through th |
| CVE-2026-55227 | 4.3 MEDIUM | Observable object existence disclosure in private Weblate projects via globally scoped obj |
| CVE-2026-77508 | 3.5 LOW | Weblate: Unverified REST API email changes |
| CVE-2026-77573 | 3.5 LOW | Weblate: DNS rebinding in VCS operations allows server-side request forgery |
IV. Related Vulnerabilities
Same product: weblate
-
CVE-2026-86035
Weblate: Mercurial argument injection via repository filenam -
CVE-2026-77573
Weblate: DNS rebinding in VCS operations allows server-side -
CVE-2026-62326
Weblate Has Uncontrolled Resource Consumption via -
CVE-2026-62249
Weblate: Restricted-component change history leaked to non-m -
CVE-2026-61792
Weblate path traversal allows a project administrator to rea
Same vendor: WeblateOrg
-
CVE-2026-86035
Weblate: Mercurial argument injection via repository filenam -
CVE-2026-62364
wlc may disclose API tokens to project-configured URLs -
CVE-2026-77573
Weblate: DNS rebinding in VCS operations allows server-side -
CVE-2026-62326
Weblate Has Uncontrolled Resource Consumption via -
CVE-2026-62249
Weblate: Restricted-component change history leaked to non-m
Same weakness: CWE-200
-
CVE-2026-108811
WMCMS index.php information disclosure -
CVE-2026-108810
tsi-coop tsi-dpdp-cms JSON Schema Validation information dis -
CVE-2026-108861
Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via exec -
CVE-2026-108578
Neterbit NW-431F Embedded Web Server sms.json information di -
CVE-2026-18496
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Infor
V. Comments for CVE-2026-77507
No comments yet