CVE-2026-62249: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in WeblateOrg weblate

CVE-2026-62249 describes an information exposure vulnerability in Weblate, a continuous localization platform. Authenticated users who have access to a project can use nested API change endpoints to enumerate change histories of restricted components within that project. These nested endpoints lack the component-level access controls that are enforced on direct component views, enabling unauthorized users to access sensitive data such as component identities, translation and unit links, and change payloads including source and translated string content. The vulnerability affects versions prior to 2026.7 and is resolved in version 2026.7.

The vulnerability allows an authenticated user with project access to view sensitive information related to restricted components that they should not have permission to see. This includes component identities and translation content, potentially leading to unauthorized disclosure of sensitive translation data. There is no indication of impact on integrity or availability.

Upgrade Weblate to version 2026.7 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated. Patch status is not explicitly stated but the fix is confirmed in version 2026.7.