-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control within Weblate's REST API, leading to two primary issues: user enumeration and Insecure Direct Object References (IDOR). The analysis of the security patch (commit 0d64cc3980d6cd1f54c029530d015dbe8c960f22) reveals several vulnerable functions.
User Enumeration: The UserViewSet.list and SearchView.get methods allowed attackers to discover valid usernames. UserViewSet.list permitted authenticated but low-privileged users to fetch user lists with short or empty search queries. SearchView.get exposed usernames to unauthenticated users through the global search functionality. The patch restricts these capabilities by enforcing a minimum query length for non-privileged users and requiring authentication for user searches.
IDOR: The UserViewSet.notifications and UserViewSet.notifications_details methods were missing authorization checks for HTTP GET requests. This allowed any authenticated user to view or retrieve the details of any other user's notification settings and subscriptions simply by manipulating the username in the API endpoint URL. The patch resolves this by implementing a new permission check (perm_check with allow_self=True) that ensures a user can only access their own resources unless they have administrative privileges.
In summary, the root cause was a failure to consistently enforce object-level permissions across all relevant API endpoints, allowing unauthorized information disclosure.
weblate.api.views.UserViewSet.listweblate/api/views.py
weblate.api.views.UserViewSet.notificationsweblate/api/views.py
weblate.api.views.UserViewSet.notifications_detailsweblate/api/views.py
weblate.api.views.SearchView.getweblate/api/views.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Weblate | pip | < 5.15 | 5.15 |