CVE-2026-39845 is a Server-Side Request Forgery (CWE-918) vulnerability affecting Weblate, a web-based localization tool. The vulnerability arises because the webhook add-on in versions before 5.17 did not utilize the SSRF protections present elsewhere in the application. This allows an attacker with high privileges to potentially induce the server to make unintended requests. The issue was addressed in Weblate version 5.17 by applying the necessary SSRF protections to the webhook add-on. No official remediation level or patch links are provided, but upgrading to version 5.17 is the recommended fix. As a temporary workaround, disabling the webhook add-on can mitigate the risk.

The vulnerability allows an attacker with high privileges to perform SSRF attacks via the webhook add-on, potentially causing the server to make unintended network requests. The CVSS vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality impact. There is no impact on integrity or availability reported. No known exploits in the wild have been reported.

Upgrade Weblate to version 5.17 or later, where the SSRF protections in the webhook add-on have been implemented. If immediate upgrade is not possible, disable the webhook add-on to mitigate the vulnerability. Patch status is not explicitly confirmed in vendor advisories, so check the official Weblate release notes or advisories for the latest remediation guidance.