4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27457

CVE-2026-27457: Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Impact

Users were able to obtain add-on configuration via API.

Patches

https://github.com/WeblateOrg/weblate/pull/18107
https://github.com/WeblateOrg/weblate/pull/18164

References

Weblate thanks @lighthousekeeper1212 for responsible disclosure.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27457

CVE-2026-27457:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.16.1	5.16.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the AddonViewSet API in Weblate. Specifically, the endpoint for listing addons did not have proper access control, causing it to leak the configuration of all addons to any authenticated user. The root cause was the use of a non-filtered queryset, Addon.objects.all(), in the AddonViewSet. When a user made a GET request to the /api/addons/ endpoint, the list method of the viewset would be called, which in turn used the overly permissive queryset, returning all addon objects.

The patch for this vulnerability, introduced in commit 3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9, addresses this by replacing the static queryset with a dynamic get_queryset method. This method checks the user's permissions and filters the addons, only returning those associated with projects the user has access to. The same commit also improves the perm_check method to handle different addon scopes correctly. A subsequent commit, 7802c9b121eb407c48d4adddd4f2458fb3efef0f, further tightens the permissions in get_queryset from allowed_projects to managed_projects, indicating that the initial fix was not restrictive enough. The key vulnerable functions are weblate.api.views.AddonViewSet.get_queryset (due to its absence and then permissive implementation) and weblate.api.views.AddonViewSet.perm_check (due to its insufficient checks).

Vulnerable functions

weblate.api.views.AddonViewSet.get_queryset

weblate/api/views.py

The `AddonViewSet` API endpoint did not properly filter the list of addons, exposing all addon configurations to any authenticated user. This was because the viewset used `Addon.objects.all()` as its default queryset. The vulnerability was fixed by implementing a `get_queryset` method that filters addons based on the user's project permissions. Initially, the fix used `allowed_projects`, which was still too permissive and was later restricted to `managed_projects`.

weblate.api.views.AddonViewSet.perm_check

weblate/api/views.py

The `perm_check` function had insufficient permission checks for addon objects. It did not properly handle different addon scopes (component, project, site-wide), potentially allowing a user to perform actions on an addon without the required permissions. The patch introduced more granular checks for each scope.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27457: Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Impact

Patches

References

CVE-2026-27457:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2026-27457: Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Impact

Patches

References

Technical Details

4.3

4.3

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI