4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55227

CVE-2026-55227: Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55227

CVE-2026-55227:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 2026.7	2026.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a common pattern across multiple view functions in the Weblate application. These functions were designed to fetch an object from the database using its primary key and then perform a permission check. The flaw in this logic is that if the object exists but the user does not have permission to view it, the server returns an HTTP 403 (Forbidden) error. If the object does not exist at all, the server returns an HTTP 404 (Not Found) error. This discrepancy, known as an observable discrepancy, allows an unauthenticated or low-privileged user to enumerate internal object IDs (like units, comments, changes, etc.) within private projects they should not have any knowledge of. By sending requests with different object IDs and observing the HTTP status code, an attacker can determine which IDs correspond to valid objects.

The patch, identified in commit 836bc082803d49d02f2831ec8339268eb66bcdae, fixes this by changing the lookup logic. Instead of fetching the object and then checking permissions, the fix first builds a queryset that is already filtered based on the user's access rights, and then attempts to retrieve the object from that restricted set. If the object is not in the accessible set (either because it doesn't exist or the user can't see it), the query returns no result, and the get_object_or_404 function correctly and consistently returns a 404 error, effectively hiding the existence of the object from unauthorized users.

Vulnerable functions

weblate.trans.views.changes.show_change

weblate/trans/views/changes.py

The function directly fetches a 'Change' object by its primary key without first checking if the user has access to it. If the object exists but the user lacks permissions, a 403 Forbidden error is returned instead of a 404 Not Found, disclosing the object's existence.

weblate.trans.views.edit.comment

weblate/trans/views/edit.py

The function directly fetches a 'Unit' object by its primary key before checking user access. This leads to an observable difference in response (403 vs. 404) that allows an attacker to determine if a 'Unit' with a given primary key exists, even within a private project.

weblate.trans.views.edit.delete_comment

weblate/trans/views/edit.py

The function fetches a 'Comment' object by its primary key without scoping the search to accessible projects. This results in a 403 error for unauthorized access to an existing comment, revealing its existence, instead of a 404 error.

weblate.trans.views.edit.resolve_comment

weblate/trans/views/edit.py

Similar to delete_comment, this function retrieves a 'Comment' object globally before access checks. This allows an attacker to probe for the existence of comments in private projects by distinguishing between 403 and 404 responses.

weblate.trans.views.edit.delete_unit

weblate/trans/views/edit.py

The function directly fetches a 'Unit' object by its ID before verifying user permissions. This allows an attacker to confirm the existence of a 'Unit' in a private project by the 403 response, as opposed to a 404 for a non-existent unit.

weblate.trans.views.js.get_unit_translations

weblate/trans/views/js.py

This function, used in an AJAX context, fetches a 'Unit' object without prior access checks. This allows for the enumeration of 'Unit' objects in private projects by observing the difference between 403 and 404 status codes.

weblate.trans.views.js.ignore_check

weblate/trans/views/js.py

The function fetches a 'Check' object directly by its ID. An unauthorized user requesting an existing but restricted 'Check' would receive a 403, confirming its existence, instead of a 404.

weblate.trans.views.js.ignore_check_source

weblate/trans/views/js.py

This function retrieves a 'Check' object by its primary key before access validation, leading to an information disclosure vulnerability where an attacker can differentiate between non-existent and existing but inaccessible objects.

weblate.trans.views.js.dismiss_automatically_translated

weblate/trans/views/js.py

The function fetches a 'Unit' object without scoping it to what the user can access. This allows an attacker to infer the existence of 'Unit' objects in private projects based on the HTTP status code (403 vs. 404).

weblate.trans.views.settings.announcement_delete

weblate/trans/views/settings.py

This function fetches an 'Announcement' object directly by its primary key. If a user tries to delete an announcement they cannot access, they receive a 403 error, which confirms the announcement's existence.

weblate.trans.views.source.edit_context

weblate/trans/views/source.py

The function fetches a 'Unit' object by its primary key without first filtering for accessibility. This allows an attacker to probe for the existence of units in private projects by observing the difference in the server's response (403 for existing but forbidden, 404 for non-existent).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-55227: Observable object existence disclosure in private Weblate projects via globally scoped object lookups

CVE-2026-55227:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

4.3

4.3

CVE-2026-55227: Observable object existence disclosure in private Weblate projects via globally scoped object lookups

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-55227: Observable object existence disclosure in private Weblate projects via globally scoped object lookups

CVE-2026-55227:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

4.3

4.3

CVE-2026-55227: Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI