CVE-2025-64725 is a vulnerability identified in Weblate, a popular web-based localization tool used for managing translation projects. The issue arises from incorrect user management (CWE-286) in versions prior to 5.15, where it is possible for a user to accept an invitation that was opened by a different user. This occurs because the application does not properly bind invitation acceptance to the intended user session, allowing a session with an invitation left open unattended to be exploited by another user with access to that session. The vulnerability requires the attacker to have low privileges on the system and to perform user interaction, such as clicking on an invitation link. The attack complexity is high, meaning it is not straightforward to exploit without specific conditions. The CVSS 4.0 score is 1.0, reflecting the low severity due to limited impact and exploitation difficulty. The vulnerability primarily affects confidentiality and integrity by potentially allowing unauthorized acceptance of invitations, which could lead to unauthorized access or actions within the localization project. There is no impact on availability. The vendor has released a patch in version 5.15 that addresses this issue by properly managing user sessions and invitation acceptance. As a workaround, users are advised not to leave Weblate sessions with invitations open unattended to prevent unauthorized acceptance. No known exploits have been reported in the wild, indicating limited active threat at this time.

For European organizations using Weblate for localization and translation management, this vulnerability could lead to unauthorized acceptance of project invitations if sessions are left unattended. This may result in unauthorized users gaining access to translation projects or sensitive localization data, potentially compromising confidentiality and integrity of the translation workflow. Although the impact is limited and exploitation requires specific conditions, organizations with collaborative translation environments could face risks of unauthorized modifications or access. The vulnerability does not affect system availability, so operational disruption is unlikely. However, in regulated industries or where translation data is sensitive (e.g., legal, financial, or governmental sectors), even limited unauthorized access could have compliance or reputational consequences. Given the low severity and absence of known exploits, the immediate risk is low but should not be ignored, especially in environments with shared workstations or where multiple users access Weblate sessions on the same device.

1. Upgrade Weblate installations to version 5.15 or later, where the vulnerability is patched. 2. Implement strict session management policies to ensure users log out or close invitation links promptly, avoiding unattended sessions with open invitations. 3. Educate users about the risk of leaving invitation links open in shared or public environments. 4. Enforce access controls on devices used to access Weblate to prevent unauthorized physical or remote access. 5. Monitor Weblate logs for unusual invitation acceptance patterns or access from unexpected users. 6. Consider implementing multi-factor authentication (MFA) for Weblate access to reduce risk of session hijacking or unauthorized use. 7. Regularly review user permissions and invitations to ensure only authorized users have access to projects. 8. If possible, isolate Weblate access to trusted networks or VPNs to reduce exposure. These measures go beyond generic advice by focusing on session hygiene, user education, and access control tailored to the nature of the vulnerability.