CVE-2026-55227

CVE-2026-55227 — Weblate Object Existence Disclosure via Authorization Bypass

Executive Summary

CVE-2026-55227 is an information disclosure vulnerability in the Weblate web-based localization tool, affecting all versions prior to 2026.7. The flaw stems from several endpoints performing globally scoped object lookups instead of restricting queries to projects the requesting user can access, causing the application to return HTTP 403 (Forbidden) rather than HTTP 404 (Not Found) for objects in private projects. This behavioral difference allows a low-privileged, authenticated user to enumerate and confirm the existence of objects—such as projects, components, or translations—within private Weblate instances, leaking sensitive metadata. The vulnerability carries a CVSS score of 4.3 (Medium), requires low-privilege authentication, and has no publicly available exploit, patch, or workaround at the time of writing.

Technical Analysis

The vulnerability resides in Weblate's object resolution logic. In a correctly implemented access control system, when an authenticated user requests a resource they are not authorized to view, the application should return HTTP 404 (Not Found) to prevent confirming the resource's existence to the requester. Returning 403 (Forbidden) implicitly confirms that the resource exists but that the user lacks permission—a classic information disclosure pattern categorized under CWE-203 (Observable Discrepancy).

The NVD description indicates that "several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access." This suggests the affected endpoints perform a database lookup for an object (e.g., a project by slug or UUID) without first filtering the query to only include objects belonging to projects the authenticated user has explicit access to. When the object is found but the enclosing project is not in the user's permitted scope, the application's authorization layer rejects the request with a 403. In contrast, if the object did not exist in the database at all, the lookup would fail and return 404.

The attack surface is the Weblate web UI and its associated JSON/REST API endpoints. Weblate is a collaborative localization platform typically deployed as a self-hosted web service and exposed to the internet for translator teams. Any endpoint that accepts a project, component, or translation identifier and performs a lookup before authorization checks is vulnerable. The NVD description does not enumerate the specific URLs or parameter names, so those remain unspecified; the vulnerability class, however, is clear: identifier-based enumeration against a resource whose existence is revealed via a 403 vs. 404 response differential.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms this is a network-exploitable issue requiring low privileges (an authenticated standard user account), no user interaction, and results in low confidentiality impact with no integrity or availability impact. The low confidentiality score reflects that the primary leak is binary existence information rather than content disclosure.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-55227. The following attack chain is inferred from the vulnerability class (CWE-203) and the NVD description.

Step 1 — Reconnaissance / target identification: The attacker first locates a Weblate instance, typically via Shodan or Google dorks such as title:Weblate or http.title:"Weblate". They then authenticate with a legitimate low-privilege account. Weblate supports self-registration on many public deployments, or the attacker may have obtained compromised credentials for a standard translator role.

Step 2 — Triggering the flaw: The attacker enumerates object identifiers. Since the endpoints perform globally scoped lookups, the attacker iterates through IDs, slugs, or UUIDs for projects, components, or translations. For example, they might request a project by a known naming convention (e.g., a company's internal project name) or brute-force numeric identifiers against the API.

Step 3 — Payload / execution at vulnerability-class level: The attacker sends HTTP requests to the vulnerable endpoints with candidate identifiers. For each request, they observe the HTTP status code:

• HTTP 404 → object does not exist anywhere
• HTTP 403 → object exists but is in a project outside the attacker's permitted scope (i.e., a private project)

The attacker scripts this enumeration using a standard HTTP client (curl, Burp Suite, or a Python script) to automate the differential analysis. No specific payload is required beyond a valid session cookie or API token. The attack is purely a response-code oracle.

Step 4 — Post-exploitation impact: Successful enumeration reveals the existence of objects within private Weblate projects. This metadata leak can expose:

• That a specific organization or product has an internal localization project (confirming business relationships or unreleased product development)
• The naming conventions and structure of internal projects
• The existence of specific components or translation languages tied to unreleased features

The attacker cannot read the actual content of the leaked objects—only their existence. However, this information can accelerate further targeted attacks (e.g., spear-phishing referencing confirmed internal projects, or prioritizing brute-force attacks against accounts with access to those projects).

Impact Assessment

Business impact: Weblate is used by enterprises to coordinate localization of software, documentation, and websites. The confidentiality leak allows unauthorized users to infer the existence of private localization projects. For organizations handling unreleased software, this can prematurely disclose planned features, product roadmaps, or internal tooling. For managed service providers running multi-tenant Weblate instances, the flaw leaks tenant data boundaries and can undermine trust in the platform's isolation guarantees.

Affected systems: All self-hosted Weblate deployments running versions prior to 2026.7. Given Weblate is typically deployed as a Dockerized or standalone web application, both containerized and bare-metal installations are affected. The vulnerability is network-exploitable and requires the attacker to possess an authenticated account, meaning public-facing instances with self-registration enabled are at elevated risk.

Blast radius: The CVSS score of 4.3 reflects low confidentiality impact. The information gained is limited to binary existence confirmation—it does not expose translation content, user details, or credentials. The practical impact is therefore restricted to metadata leakage. However, in environments where project names themselves are sensitive (e.g., a defense contractor hosting "Project-Codename-X" localization), even existence confirmation constitutes a meaningful breach. The vulnerability requires no user interaction and has a low attack complexity, making it trivially automatable.

Detection Guidance

Detection of this vulnerability hinges on identifying anomalous enumeration behavior: many requests to the same endpoints with varying identifiers, a high ratio of 403 responses, or systematic probing of object identifiers. The following detection content is provided to aid SOC teams and can be adapted to local logging capabilities. Note that since no exploit exists in the wild, these rules target the enumeration pattern rather than a specific payload signature.

Sigma Rule

title: Weblate Object Existence Enumeration via 403/404 Differential
id: 9f8e7d6c-5b4a-4c3b-2a19-9f8e7d6c5b4a
status: experimental
description: Detects systematic enumeration attempts against Weblate endpoints by a single user, characterized by a high volume of 403 responses within a short time window, indicating object existence probing.
logsource:
  category: webserver
  product: nginx | apache | caddy
detection:
  selection:
    http.response.status_code:
      - 403
      - 404
    cs-url.path|contains:
      - /api/projects/
      - /projects/
  condition: selection
  timeframe: 5m
  group-by:
    - cs-username
    - srcip
  aggregation:
    min_count: 30
    max_count: 500
  condition: selection
  condition: aggregation >= 30
falsepositives:
  - Legitimate automated testing or monitoring tools
  - Users with broken bookmarks hitting deleted project URLs
level: medium
tags:
  - attack.t1190
  - cve.2026-55227
  - cwe.203

YARA Rule

rule Weblate_ObjectEnum_403_404_LogTrail
{
    meta:
        author = "Valter Security Threat Intelligence"
        description = "Detects log sequences indicating Weblate object-existence enumeration attack pattern"
        cve = "CVE-2026-55227"
        date = "2026-11-10"
    strings:
        $s1 = "403" ascii
        $s2 = "404" ascii
        $s3 = "GET /api/projects/" ascii
        $s4 = "GET /projects/" ascii
    condition:
        2 of ($s1, $s2) and 1 of ($s3, $s4)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB Weblate Object Existence Enumeration Attempt (CVE-2026-55227)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/projects/"; nocase; threshold:type both, track by_src, count 30, seconds 300; classtype:attempted-recon; sid:202655227; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [http where http.response.status_code == 403 and http.request.method == "GET" and (http.request.uri like "*api/projects/*" or http.request.uri like "*projects/*")]
  [http where http.response.status_code == 403 and http.request.method == "GET" and (http.request.uri like "*api/projects/*" or http.request.uri like "*projects/*")]
  [http where http.response.status_code == 403 and http.request.method == "GET" and (http.request.uri like "*api/projects/*" or http.request.uri like "*projects/*")]
  [http where http.response.status_code == 404 and http.request.method == "GET" and (http.request.uri like "*api/projects/*" or http.request.uri like "*projects/*")]

Splunk SPL Query

index=web sourcetype=access_combined status=403 OR status=404
  (uri="/api/projects/*" OR uri="/projects/*")
| stats count as request_count by src_ip, user
| where request_count > 30
| eval malicious_ratio = (eval(count(eval(status=403))/request_count) * 100)
| where malicious_ratio > 30
| table _time, src_ip, user, request_count, malicious_ratio

Wazuh OSSEC Rule

<group name="weblate,cve-2026-55227,">
    <rule id="552270" level="8">
        <decoded_as>json</decoded_as>
        <field name="url">\.(api/projects/|projects/)\.*</field>
        <field name="status" type="pcre2">^(403|404)$</field>
        <description>Weblate: Multiple 403/404 responses detected - possible object enumeration (CVE-2026-55227)</description>
        <group>recon,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, patch file, or hotfix has been released by the Weblate project at the time of this report beyond the upstream fix in version 2026.7. No third-party patches or workarounds are currently available.

1. Immediate mitigations (while unpatched):

• Disable user self-registration on public-facing Weblate instances to reduce the pool of potential low-privilege attackers. If self-registration is required for business operations, implement an approval workflow.
• Restrict network access to the Weblate web interface using firewall rules or VPN requirements, limiting exposure to trusted IP ranges.
• If the Weblate instance is exposed to the internet, place it behind a reverse proxy with rate limiting (e.g., nginx limit_req) to slow down automated enumeration attempts.
• Monitor web access logs for anomalous 403/404 patterns on project-related endpoints and escalate alerts to the incident response team.

2. Patch / upgrade steps:

• Upgrade Weblate to version 2026.7 or later as soon as the release is available. According to the NVD description, the fix is included in version 2026.7. The upgrade process typically involves pulling the new Docker image or updating the package, backing up the database first, and running the migration scripts.
• After upgrading, verify the fix by requesting an object from a private project using a low-privilege account and confirming the response is now HTTP 404.

3. Long-term hardening:

• Enforce the principle of least privilege across Weblate user roles; audit existing accounts and remove stale or overly privileged users.
• Implement a Web Application Firewall (WAF) rule to normalize 403 and 404 responses for authenticated endpoint access, making the response differential less deterministic.
• Conduct periodic security reviews of Weblate's authorization logic and test for CWE-203 (Observable Discrepancy) patterns during application security assessments.
• Consider deploying Weblate in a private network segment with SSO (e.g., SAML/OIDC) to centralize access control and reduce reliance on the application's internal authorization.

References

• NVD Entry: CVE-2026-55227 — https://nvd.nist.gov/vuln/detail/CVE-2026-55227
• Weblate Project Home & Release Notes: https://weblate.org/ (version 2026.7 release notes)
• MITRE ATT&CK Technique T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CWE-203: Observable Discrepancy — https://cwe.mitre.org/data/definitions/203.html
• CISA KEV Catalog: CVE-2026-55227 is NOT listed in the Known Exploited Vulnerabilities catalog as of the report date.

Threat actor activity: No campaigns exploiting CVE-2026-55227 have been observed in the wild. No exploit code, proof-of-concept, or Nuclei template exists. The vulnerability is designated as unpatched in this assessment; however, the fix in version 2026.7 is confirmed by the NVD description, which diverges from the "UNPATCHED" patch-confidence flag—enterprises should prioritize the upgrade to 2026.7 to remediate the exposure.