{"id":"CVE-2026-50127","aliases":["GHSA-vmfc-9982-2m45"],"title":"Weblate SSRF: outbound URL guard misses some private ranges","summary":"Weblate SSRF: outbound URL guard misses some private ranges","severity":"medium","cvss":5.9,"cwe":["CWE-918"],"vendor":"weblate","product":"weblate","ecosystem":"pip","affected":["weblate >= 5.15, < 2026.6"],"patched":["weblate 2026.6"],"published":"2026-07-07","updated":"2026-07-07","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-vmfc-9982-2m45","references":[{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50127"},{"url":"https://github.com/WeblateOrg/weblate/pull/19768"},{"url":"https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6"},{"url":"https://github.com/advisories/GHSA-vmfc-9982-2m45"}],"tags":["ghsa","pip"],"epss":0.00308,"epssPercentile":0.23821,"ingestedAt":"2026-07-08T00:44:25.696Z","slug":"CVE-2026-50127","body":"## Overview\n\n### Impact\n\nWeblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.\n\n### Patches\n\n* https://github.com/WeblateOrg/weblate/pull/19768\n\n### Resources\n\nThe issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.\n\n## Affected packages\n\n- `weblate >= 5.15, < 2026.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `weblate 2026.6`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}