4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33214

CVE-2026-33214: Weblate has improper access control for the translation memory API

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33214

CVE-2026-33214:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.17	5.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the weblate.api.views.MemoryViewSet class, which is responsible for handling API requests related to the translation memory. The root cause of the vulnerability is that this class inherited from rest_framework.viewsets.ModelViewSet. In Django REST Framework, ModelViewSet automatically provides a full set of read-write actions: list, create, retrieve, update, partial_update, and destroy. The vulnerability advisory states that the translation memory API exposed unintended endpoints, and the commit message confirms that "Editing or creating entries was not supposed to be available here."

The patch, found in commit 55625f2c28bc8d1f4a86af8e374c3c16d84d2c63, addresses this issue by changing the base class of MemoryViewSet from ModelViewSet to ReadOnlyModelViewSet. The ReadOnlyModelViewSet only provides list and retrieve actions, effectively removing the vulnerable create, update, partial_update, and destroy endpoints and restricting the API to read-only access as intended. An attacker could have exploited this by sending crafted HTTP requests (POST, PUT, PATCH, DELETE) to the /api/memory/ endpoint to create, modify, or delete translation memory entries without proper authorization.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.