{"id":"CVE-2026-55227","aliases":["GHSA-2p9g-x3cv-5hh4","PYSEC-2026-3941"],"title":"Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups","summary":"Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","vendor":"weblate","product":"weblate","ecosystem":"pip","affected":["weblate < 2026.7"],"patched":["weblate 2026.7"],"published":"2026-08-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T12:25:56.525025144Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2p9g-x3cv-5hh4","references":[{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2p9g-x3cv-5hh4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55227"},{"url":"https://github.com/WeblateOrg/weblate/pull/19971"},{"url":"https://github.com/WeblateOrg/weblate/commit/836bc082803d49d02f2831ec8339268eb66bcdae"},{"url":"https://github.com/WeblateOrg/weblate"},{"url":"https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.7"},{"url":"https://pypi.org/project/weblate"},{"url":"https://github.com/advisories/GHSA-2p9g-x3cv-5hh4"}],"tags":["osv","pip","nvd","ghsa"],"epss":0.00194,"epssPercentile":0.09312,"cwe":["CWE-203"],"ingestedAt":"2026-08-28T19:24:19.150Z","slug":"CVE-2026-55227","body":"## Overview\n\n### Impact\nThe several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/19971\n\n### References\nThanks to Yaohui Wang for reporting this via GitHub.\n\n## Affected packages\n\n- `weblate < 2026.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `weblate 2026.7`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}