-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, as described, involves the leakage of an administrator's IP address to an invited user through the audit log. The analysis of the provided patch commit b847e9756a0a6f7659ef20fa9f34846ca862c574 confirms this. The key change is in weblate/accounts/models.py, specifically within the create method of the AuditLogManager class. Before the patch, this method always extracted the IP address from the request. The fix introduces a conditional check to ensure that the IP address is only logged if the user associated with the request is the same as the user for whom the audit log entry is being created. This prevents the IP of an administrator from being logged when they perform an action on behalf of another user, such as an invitation. The database migration included in the patch further corroborates this by explicitly removing IP addresses from historical audit logs for activities like 'invited'.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| weblate | pip | < 5.14.1 | 5.14.1 |