CVE-2026-55228

Executive Summary

CVE-2026-55228 is an authorization bypass vulnerability in Weblate, a web-based continuous localization platform, affecting all versions prior to 2026.7. A low-privileged authenticated user can exploit improper scope enforcement in the REST API regarding project- and workspace-scoped teams to grant themselves (or others) access to private projects and perform unauthorized translation, repository, and project-management operations. With a CVSS score of 8.1 (High), successful exploitation leads to full confidentiality and integrity compromise of project data, although availability is not affected.

Technical Analysis

Vulnerability Class: CWE-639 — Authorization Bypass Through User-Controlled Key. This issue belongs to the family of vulnerabilities where the application fails to verify that an authenticated user has the authority to modify or reference specific objects identified by user-supplied parameters. In this case, the REST API fails to properly validate the scope of team configurations submitted by users.

Attack Surface: The vulnerability resides in the REST API of Weblate. The API allows authenticated users to manage team configurations, including the assignment of projects to teams. The flaw lies in the authorization logic that governs whether a user may assign a given project to a team, and whether the team's scope (project or workspace level) is correctly constrained to objects the user is permitted to manage.

Mechanism of the Flaw: The NVD description states that "the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API." The description further specifies that "by assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage." This indicates a server-side authorization failure: the endpoint responsible for team–project association either:

1. Fails to check whether the requesting user has manage or admin rights over the target project before accepting the association, or
2. Accepts team configurations where the team's declared scope does not match the resources being attached, leading to privilege escalation when the team's membership is later evaluated.

It is worth noting that the NVD description does not provide specific endpoint paths, parameter names, or function names associated with this flaw. Insufficient technical detail is available at the code level; however, the vulnerability class (CWE-639) strongly implies that the API accepts a project identifier supplied by the user and performs the association without an adequate access-control check.

Preconditions for Exploitation:

• The attacker must possess a valid Weblate account with at least low-level access (CVSS vector indicates PR:L — Low Privilege).
• The Weblate instance must expose the REST API.
• The instance must be running version 2026.6 or earlier.

Impact of the Flaw: By exploiting this authorization gap, an attacker can associate projects with teams they control, thereby inheriting the team's effective rights over those projects. This can result in unauthorized read access to translation content and private project metadata, and unauthorized write access allowing translation modifications, repository pushes/pulls, and project configuration changes.

Exploitation Scenarios

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker with a low-privileged account on a Weblate instance identifies the REST API endpoint used for team management. The attacker enumerates available projects via API queries or the web interface to identify private projects that are not visible or accessible from their account. The goal is to find project IDs or unique project identifiers associated with projects outside their permitted scope.

Step 2 — Triggering the Flaw: The attacker submits an API request to create or update a team configuration, specifically attempting to assign a target project (one the attacker is not authorized to access) to a team under the attacker's control. Because the API fails to validate that the attacker has management rights over the specified project, the request is accepted. The attack relies on the server-side authorization check being absent or improperly scoped — the attacker is able to reference a project they cannot otherwise see.

Step 3 — Payload / Execution at the Vulnerability-Class Level: At the class level, this is an IDOR/authorization bypass via an API object reference. The attacker supplies a project identifier in the request body (e.g., a numeric ID, slug, or UUID) without proper server-side verification of ownership or permission. The REST API processes the request and persists the team–project association. The attacker may repeat this for multiple projects or escalate by assigning the team administrative roles over the attached projects.

Step 4 — Post-Exploitation Impact: Once the association is established, the attacker's account inherits the team's permissions over the previously inaccessible projects. This enables:

• Confidentiality breach: Reading private translation strings, glossaries, screenshots, and project metadata.
• Integrity breach: Modifying translations, adjusting source strings, triggering repository synchronization (pushing/pulling from connected version control systems), and altering project configuration such as access controls, workflows, or language settings.
• Potential lateral movement: If the attached projects connect to external Git repositories with stored credentials, the attacker may gain indirect access to external systems, depending on the platform's integration architecture.

Feasibility Notes: The attack requires authentication but is otherwise remotely exploitable without user interaction. The lack of any published exploit or PoC suggests that the vulnerability may have been recently discovered and disclosed, or that exploitation requires deeper knowledge of the API structure than is currently public.

Impact Assessment

Business Impact:

• Confidentiality (High): Private localization projects, potentially containing unreleased product strings, proprietary terminology, or sensitive in-app messaging content, become exposed to unauthorized users.
• Integrity (High): Attackers can alter translation files and project settings. Malicious translation strings could be pushed into release branches, potentially shipping incorrect, offensive, or malicious text to end users of the localized products.
• Availability (None per CVSS): The attack does not directly lead to denial of service, though repository operations could disrupt CI/CD workflows if abused.

Affected Systems: All Weblate instances running versions prior to 2026.7 with an exposed REST API. This includes both self-hosted deployments and any managed/cloud instances that have not been upgraded.

Blast Radius: Potentially large for enterprises using Weblate as their central localization hub. The platform frequently integrates with multiple upstream software repositories; a compromise could affect many downstream projects and the release pipeline of localized software products. Multi-tenant Weblate deployments are at highest risk, as a single low-privileged tenant user could gain access to other tenants' projects.

ATTCK Mapping: This vulnerability aligns primarily with T1190 (Exploit Public-Facing Application). Post-exploitation activities would map to T1530 (Data from Information Repositories) for confidentiality impact and T1499/T1485 for integrity impact depending on the attacker's end goal.

Detection Guidance

Sigma Rule

title: Weblate REST API - Suspicious Team-Project Assignment
id: 3f2e6b8a-5d42-4c9a-b2a5-1e9d7f0c44bb
status: experimental
description: Detects API requests that assign projects to teams in Weblate, potentially indicating CVE-2026-55228 exploitation attempts.
author: Valtersit Threat Intel
date: 2026/01/01
logsource:
    category: application
    product: weblate
    service: api
detection:
    selection:
        http.url|contains|all:
            - '/api/'
            - '/team'
        http.method: 'POST'
    filter_known_scopes:
        http.url|contains:
            - '/teams/'  # legitimate team creation path
    filter_authorized_roles:
        http.url|contains:
            - '/projects/'
        http.user_agent|contains: 'WeblateBot'  # exclude system bot
    condition: selection and not filter_known_scopes and not filter_authorized_roles
level: medium
falsepositives:
    - Legitimate project administrators assigning projects to teams through the UI which generates API calls
tags:
    - attack.t1190
    - cve.2026-55228
    - cwe.639

YARA Rule

rule weblate_cve_2026_55228_api_traffic
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects HTTP requests targeting Weblate team assignment API endpoints indicating possible CVE-2026-55228 exploitation"
        date = "2026-01-01"
        cve = "CVE-2026-55228"
        score = 60
    strings:
        $team_endpoint = "/teams/" ascii nocase
        $project_endpoint = "/projects/" ascii nocase
        $api_path = "/api/" ascii nocase
        $post_method = "POST" ascii nocase
        $assign_keyword = "assign" ascii nocase
        $project_id_key = "project_id" ascii nocase
        $team_scope_key = "scope" ascii nocase
    condition:
        all of them and filesize < 100KB
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"ET WEB_SPECIFIC_APPS Weblate REST API Team Project Assignment Attempt (CVE-2026-55228)"; flow:established,to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:"/teams/"; http_uri; content:"/projects/"; http_uri; content:"assign"; http_uri; classtype:attempted-admin; sid:100000001; rev:1; reference:cve,2026-55228;)

Elastic Detection

// Elastic EQL query - detect Weblate REST API team assignment POST requests
sequence by source.ip
  [network where event.category == "web" and http.request.method == "POST"
   and http.request.uri.text like "*api*" and http.request.uri.text like "*team*"]
  [network where event.category == "web" and http.request.method == "POST"
   and http.request.uri.text like "*project*" and http.request.body.content like "*assign*"]

Splunk SPL Query

index=weblate sourcetype=access_combined_wc
| search method=POST uri="*/api/*" 
| where like(uri, "%/teams/%") OR like(uri, "%/team/%")
| where like(payload, "%assign%") OR like(form, "%project%")
| stats count by clientip, user, uri, status
| sort - count
| table _time, clientip, user, uri, status, count

Wazuh OSSEC Rule

<group name="weblate,">
  <rule id="100505" level="8">
    <decoded_as>json</decoded_as>
    <field name="component">weblate</field>
    <field name="method">POST</field>
    <field name="uri" type="pattern">/api/*</field>
    <field name="uri" type="pattern">*team*</field>
    <field name="uri" type="pattern">*assign*</field>
    <description>Weblate REST API: Possible unauthorized team-project assignment (CVE-2026-55228)</description>
    <group>cve-2026-55228,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. While the NVD description indicates the issue "is fixed in version 2026.7," no independent confirmation of the patch's availability or integrity has been established through vendor channels.

Immediate Mitigations (temporary, until patch verified):

1. Disable REST API write access: If the REST API is not essential for day-to-day operations, restrict or disable it at the reverse-proxy or application firewall layer.
2. Network-level restriction: Restrict access to the Weblate REST API to trusted IP ranges only (VPN, office networks, CI/CD servers).
3. Review team membership logs: Audit all team–project associations in your Weblate instance; look for anomalies such as recently created teams with unexpected project assignments.
4. Review project visibility: In the Weblate admin UI, verify the visibility and access-control settings on all projects; confirm that no project is incorrectly marked as "public" or shared with the wrong group.
5. Enable multi-factor authentication (MFA): If using LDAP/SSO integration, enforce MFA to reduce the risk of a low-privileged account being attacker-controlled.

Patch/Upgrade Steps:

1. Verify the Weblate version of your deployment (weblate --version).
2. Monitor the official Weblate release channels for version 2026.7 availability.
3. If you are on a managed/cloud plan, contact your provider and confirm whether the fix has been applied.
4. If self-hosting: Download version 2026.7 from the official release repository and upgrade following the official upgrade guide. Important: Due to the 0/4 patch confidence, test the upgrade in a staging environment first and verify checksum integrity of the release artifact.
5. After upgrade, execute a manual API test to confirm the authorization check is enforced: attempt to assign a project to a team using an account without permissions and verify the request is rejected.

Long-Term Hardening:

1. Least-privilege policy: Review all user roles in Weblate; ensure no user has unnecessary team-management or project-management rights.
2. API audit logging: Enable verbose API access logging and integrate it with your SIEM for continuous monitoring.
3. Regular version hygiene: Adopt a policy of upgrading within 30 days of any security release from Weblate.
4. Periodic access review: Quarterly review of team scopes and project permissions to detect configuration drift or unauthorized changes.
5. Web Application Firewall (WAF): Deploy a WAF with API-security capabilities in front of Weblate to detect abnormal API usage patterns, including unusual object-reference manipulation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-55228
2. Weblate Official Site / Release Notes: https://weblate.org/ (monitor for version 2026.7 release notes)
3. Weblate Repository (GitHub): https://github.com/WeblateOrg/weblate — check for security-related commits and release tags
4. CWE-639 Reference: https://cwe.mitre.org/data/definitions/639.html
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

Threat Actor / Exploitation-in-the-Wild Status: No known threat actor campaigns or exploits-in-the-wild have been reported as of the writing of this report. The CVE is not listed on the CISA KEV catalog. EPSS has not yet scored this vulnerability; organizations should treat it as exploitable given the high CVSS score and the prevalence of localization platforms reaching the public internet.