{"id":"CVE-2026-21889","aliases":["GHSA-3g2f-4rjg-9385","PYSEC-2026-2037"],"title":"Weblate leaks information via screenshots","summary":"Weblate leaks information via screenshots","severity":"low","vendor":"weblate","product":"weblate","ecosystem":"pip","affected":["weblate < 5.15.2"],"patched":["weblate 5.15.2"],"published":"2026-01-14","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3g2f-4rjg-9385","references":[{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21889"},{"url":"https://github.com/WeblateOrg/weblate/pull/17516"},{"url":"https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47"},{"url":"https://github.com/WeblateOrg/weblate"}],"tags":["osv","pip"],"epss":0.00378,"epssPercentile":0.31712,"ingestedAt":"2026-07-08T18:25:44.902Z","slug":"CVE-2026-21889","body":"## Overview\n\n### Impact\nThe screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/17516\n\n### References\n\nThanks to Lukas May and Michael Leu for reporting this.\n\n## Affected packages\n\n- `weblate < 5.15.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `weblate 5.15.2`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}