3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33212

CVE-2026-33212: Weblate: Improper access control for pending tasks in API

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33212

CVE-2026-33212:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.17	5.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the get_task function in weblate/api/views.py, which is responsible for retrieving task information for the API. The function failed to properly enforce access controls for tasks that were still in a 'PENDING' state. This is because the logic for retrieving the associated component or translation (which is needed for the permission check) relied on the task's result being available, which is not the case for pending tasks. The patch addresses this by introducing a new mechanism to store and retrieve task metadata (specifically component_id and translation_id) in the cache when a task is created. The get_task function was modified to use this metadata to fetch the associated object and perform the permission check, even for pending tasks. The TaskViewSet.retrieve method is the API endpoint that calls the vulnerable get_task function, making it the entry point for a potential exploit.

Vulnerable functions

weblate.api.views.get_task

weblate/api/views.py

The `get_task` function in `weblate/api/views.py` was vulnerable to an improper access control issue. Before the patch, when a task was in a 'PENDING' state, the function would not have access to the task's result, which contained the information needed to determine the associated component or translation for a permission check. This resulted in the access control check being bypassed for pending tasks, allowing an authenticated user to potentially access information about any pending task by guessing its UUID.

weblate.api.views.TaskViewSet.retrieve

weblate/api/views.py

The `retrieve` method of the `TaskViewSet` is the API endpoint that exposes the vulnerability in `get_task`. It takes a task's primary key (UUID) and calls `get_task` to fetch the task's details. An attacker would target this endpoint to exploit the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.