CVE-2026-61790: CWE-284: Improper Access Control in WeblateOrg weblate
Description
Weblate versions prior to 2026.7 have an improper access control vulnerability where two-factor authentication (2FA) enforcement is inconsistent. While teams can require 2FA for team permissions, this requirement is not enforced for site-wide global permissions. As a result, users without 2FA configured can still receive and act on global permissions, including accessing the site management interface. This issue is fixed in version 2026.7.
CVSS v3.1
Score 4.4medium
Affected software
WeblateOrg
weblate
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-61790 describes an improper access control vulnerability (CWE-284) in Weblate, a web-based localization platform. In versions before 2026.7, team-enforced 2FA requirements apply to project-, component-, and workspace-scoped permissions but not to site-wide global permissions. Consequently, users who belong to a team requiring 2FA but lack 2FA themselves can still gain global permissions and access sensitive management interfaces. This inconsistency allows privilege escalation to global permissions without 2FA. The vulnerability is resolved in Weblate version 2026.7.
Potential Impact
Users without two-factor authentication configured can gain and exercise site-wide global permissions if they belong to a team that enforces 2FA, potentially allowing unauthorized access to the site management interface. This elevates the risk of unauthorized administrative actions. The CVSS score of 4.4 (medium severity) reflects the network attack vector, high attack complexity, and required privileges but no user interaction needed. There is no indication of known exploits in the wild.
Mitigation Recommendations
Upgrade Weblate to version 2026.7 or later, where this improper access control issue is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in 2026.7.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-10T20:06:05.617Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8f55a0acd9273b496333ab
Added to database: 08/26/2026, 21:07:44 UTC
Last enriched: 09/10/2026, 09:54:14 UTC
Last updated: 10/10/2026, 06:48:18 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.