8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34393

CVE-2026-34393: Weblate: Privilege escalation in the user API endpoint

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34393

CVE-2026-34393:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.17	5.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as a privilege escalation in the user API endpoint, stems from insufficient permission enforcement when updating user and group objects via the REST API. The analysis of the patch reveals two main issues.

First, the UserViewSet did not correctly differentiate between a privileged administrator editing any user and a regular user editing their own profile. For update and partial_update actions, it would use the FullUserSerializer if the user had user.view permissions. This serializer, prior to the patch, lacked field-level security, allowing users to modify sensitive fields on their own account, such as is_superuser or groups, leading to privilege escalation. The fix introduces a new, more restrictive SelfUserSerializer for this scenario and adds a defense-in-depth check within FullUserSerializer to make privileged fields read-only for users without the user.edit permission.

Second, the GroupViewSet's update and destroy methods lacked object-level permission checks. The permission check (perm_check) was called without the specific group object being modified, meaning the check was not granular enough. This could allow a user with general group editing permissions to modify or delete groups for which they were not authorized.

The identified vulnerable functions are the API view methods (update, partial_update) that handle the modification requests and the serializer method (get_fields) where the permission checks were missing and subsequently added.

Vulnerable functions

weblate.api.views.UserViewSet.update

weblate/api/views.py

This function handles PUT requests to update user objects. It was vulnerable because it used a serializer (`FullUserSerializer`) that did not properly restrict which fields a non-privileged user could edit on their own profile. This allowed a user to modify fields like `is_superuser`, leading to privilege escalation.

weblate.api.views.UserViewSet.partial_update

weblate/api/views.py

This function handles PATCH requests to update user objects. It was vulnerable because it used a serializer (`FullUserSerializer`) that did not properly restrict which fields a non-privileged user could edit on their own profile. This allowed a user to modify fields like `is_superuser`, leading to privilege escalation.

weblate.api.serializers.FullUserSerializer.get_fields

weblate/api/serializers.py

This method was added to the `FullUserSerializer` to perform field-level permission checks. Before this change, the serializer would allow modification of privileged fields (e.g., `is_superuser`, `is_active`, `groups`) by any user who was assigned this serializer, regardless of whether they had the `user.edit` permission. This lack of fine-grained control was a core part of the privilege escalation vulnerability.

weblate.api.views.GroupViewSet.update

weblate/api/views.py

The `update` method for groups was not performing an object-level permission check. It only checked for general permission to edit groups, but not for the specific group being edited. This could allow a user to modify a group they do not have permissions for.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.