{"id":"CVE-2026-55228","aliases":["GHSA-2q2q-jr9g-v9rf","PYSEC-2026-3942"],"title":"Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project","summary":"Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","vendor":"weblate","product":"weblate","ecosystem":"pip","affected":["weblate < 2026.7"],"patched":["weblate 2026.7"],"published":"2026-08-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T12:26:08.096875370Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2q2q-jr9g-v9rf","references":[{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2q2q-jr9g-v9rf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55228"},{"url":"https://github.com/WeblateOrg/weblate/pull/19970"},{"url":"https://github.com/WeblateOrg/weblate/commit/19babc99b05f2cc299b5090f90f79d8181f25d79"},{"url":"https://github.com/WeblateOrg/weblate"},{"url":"https://pypi.org/project/weblate"},{"url":"https://github.com/advisories/GHSA-2q2q-jr9g-v9rf"}],"tags":["osv","pip","nvd","ghsa"],"epss":0.00257,"epssPercentile":0.17678,"cwe":["CWE-639"],"ingestedAt":"2026-08-28T19:24:19.109Z","slug":"CVE-2026-55228","body":"## Overview\n\n### Impact\nThe API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/19970\n\n\n### References\n\nParts of this issue were independently reported by four reporters:\n * @H3xV0rT3x via GitHub\n * [imhego](https://hackerone.com/imhego) via HackerOne\n * [v01demort](https://hackerone.com/v01demort) via HackerOne\n * [b4nder](https://hackerone.com/b4nder) via HackerOne\n\n## Affected packages\n\n- `weblate < 2026.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `weblate 2026.7`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}