2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21889

CVE-2026-21889: Weblate leaks information via screenshots

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21889

CVE-2026-21889:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.15.2	5.15.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability was an improper access control issue where screenshot images were served directly by the HTTP server (e.g., Nginx, Apache) without any authentication or authorization checks by the Weblate application. The application's templates generated direct URLs to these files within the /media/ directory. This allowed an unauthenticated attacker who could guess the file path to access potentially sensitive information in the screenshots.

The patch remediates this architectural flaw by removing the direct serving of the /media/ directory from the web server configuration. Instead, it introduces a new Django view, ScreenshotView, which acts as a controlled proxy for serving screenshot images. This view utilizes a new base class, ScreenshotBaseView, which contains the get_object method. This method enforces access control by checking if the requesting user has the appropriate permissions for the project component associated with the screenshot. The application's templates were updated to point to this new secure view, ensuring that all screenshot access is now mediated and authorized by the application.

Vulnerable functions

ScreenshotView.get

weblate/screenshots/views.py

This function was introduced as part of the patch to fix the vulnerability. The vulnerability existed because screenshot images were served directly by the web server, bypassing application-level access control. This function acts as a proxy view that serves the image file only after performing an access control check via its call to `get_object`. The absence of such a controlled view was the root cause of the vulnerability.

ScreenshotBaseView.get_object

weblate/screenshots/views.py

This function was introduced in the patch to provide the access control logic that was previously missing when accessing screenshot images. It is called by the new `ScreenshotView` and ensures that a user has the necessary permissions for the associated component before the screenshot object is retrieved and served. The lack of this check in the previous architecture, which served files directly from the web server, was the core of the information leak vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.