CVE-2026-61790

Executive Summary

CVE-2026-61790 is an authorization enforcement flaw in Weblate, a web-based continuous localization platform, affecting all versions prior to 2026.7. The vulnerability allows a user who has joined a team requiring two-factor authentication (2FA) to receive and exercise site-wide global permissions without having configured 2FA, because the 2FA prerequisite is enforced for project-, component-, and workspace-scoped permissions but not for global permissions. A successful attacker exploiting this issue can access the site management interface at /manage/ and perform administrative actions, leading to unauthorized disclosure of sensitive data (CVSS confidentiality impact: High). The vulnerability scored 4.4 on the CVSS 3.1 scale, reflecting the elevated privilege requirement (PR:H) to exploit.

Technical Analysis

Weblate implements a permission model where teams can be granted permissions scoped to projects, components, workspaces, or the entire site (global permissions). When a team is configured to require its members to enroll in 2FA, the platform conditionally gates the assignment of permissions: members must have 2FA enabled before the system grants them the team's scoped permissions. The NVD description indicates that this conditional enforcement was applied to project-, component-, and workspace-scoped permission grants, but the same condition was omitted from the code path that assigns site-wide global permissions.

The vulnerability class is a missing authorization check (CWE-284 — Improper Access Control). Specifically, the conditional authorization check (2FA enrollment is "active") that gates the delegation of team permissions is inconsistently applied across different permission scopes. The global permission grant path lacks the same "is 2FA configured" predicate that the project-, component-, and workspace-scoped grant paths contain.

Attack surface: The affected functionality is reachable via the Weblate web interface. The attacker must be an authenticated user who has been added to a team that (a) enforces 2FA for its members and (b) has been granted one or more site-wide global permissions (such as the ability to access the site management interface). Because the vulnerability is server-side logic missing an authorization check, the attack vector is network-based (AV:N) but requires valid credentials for a user in such a team (PR:H) and a non-trivial precondition — the team must have been misconfigured with a global permission grant. No user interaction is required (UI:N).

Code-level detail: The NVD description does not reveal source-level function names, file paths, or database columns. Per accuracy rules, we note that insufficient technical detail is available to name the specific functions embedded in the grant-assignment logic. The flaw is logically located in the team-permission delegation service likely within the authentication/authorization module that mediates the transition between "team membership accepted" and "permission effectively assigned," where the 2FA pre-check was applied to scoped grants but bypassed for global grants.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-61790. The attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance/Target Identification: The attacker identifies a Weblate instance running a version prior to 2026.7. In doing so, they may use Shodan queries (e.g., http.title:"Weblate") to find exposed instances. They also need to identify whether any team on that instance enforces 2FA and holds global permissions — likely requiring internal knowledge or social engineering.

Step 2 — Triggering the Flaw: The attacker obtains valid credentials for a user account that is a member of a team enforcing 2FA. Crucially, that user must not have 2FA configured on their own account. In the normal (correct) flow, the platform would reject the delegation of team permissions until the user enables 2FA. Due to the flaw, the global permission is granted anyway when the team's permissions are (re)computed — e.g., on login, on team membership change, or on permission refresh.

Step 3 — Payload/Execution at Class Level: Since this is an improper access control flaw and not an injection or memory-corruption bug, there is no payload in the traditional sense. The "execution" is the act of exercising the erroneously granted administrative privilege — navigating to the /manage/ endpoint (explicitly named in the NVD description) and invoking site-management operations. The attacker notes that the page is accessible without 2FA challenge or enrollment, confirming the bypass.

Step 4 — Post-Exploitation Impact: With global permissions, the attacker can reach the site management interface and potentially view or modify site-wide configuration data, user lists, translation project data, or other sensitive records. The CVSS confidentiality impact is rated High (C:H), while integrity and availability are rated None, suggesting the primary impact is unauthorized data exposure rather than destructive actions.

Pitfall note: No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

• Business impact: For organizations operating a Weblate instance, this flaw allows an insider or compromised low-privileged user (a member of a 2FA-enforcing team) to bypass a security control (mandatory 2FA) that the organization explicitly deployed. The most direct impact is unauthorized read access to site-wide management data, which may include user lists, project configuration, and localization metadata — potentially containing proprietary or sensitive project context.
• Affected systems: All self-hosted Weblate deployments running versions prior to 2026.7. Cloud-hosted Weblate (weblate.org) is presumed to be managed by the vendor and updated automatically, but per the NVD data, no confirmation is provided; administrators should verify their hosted plan version.
• Blast radius: The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) yields a base score of 4.4. The High confidentiality impact means data exposure is the main consequence; integrity and availability are unaffected within the scope of this vector. However, since the attacker can reach the management interface (/manage/), there is potential for broader lateral privilege escalation within the application if other sensitive endpoints are reachable.
• Scope: The vector flags S:U (Unchanged), meaning the exploited component (the permission-assignment logic) and the impacted component (the management interface) are the same security domain, and no other system components are compromised by this specific flaw.

Detection Guidance

Sigma Rule

title: Weblate Global Permission Bypass Without 2FA (CVE-2026-61790)
id: 3f6b3c3e-1e2a-4e9d-b6f2-0b1c3d4e5f6a
status: experimental
description: Detects login or session events from users who lack 2FA configuration but who hold site-wide global permissions in Weblate prior to 2026.7.
author: Valtersit Threat Intel
logsource:
    product: weblate
    category: application
detection:
    selection_management:
        event.action: "user.login"
        user.permissions.global: true
    filter_no_2fa:
        user.two_factor_enabled: false
    condition: selection_management and filter_no_2fa
falsepositives:
    - Users who have 2FA enforced by external identity provider (SAML/OIDC) rather than Weblate-native 2FA
level: medium
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-61790
tags:
    - attack.initial_access
    - cve.2026-61790

YARA Rule

rule Weblate_Global_Permission_Bypass_CVE_2026_61790
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects Weblate log entries or error messages indicating a user granted global permissions without 2FA."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61790"
        date = "2026-06-01"
    strings:
        $a = "global permission" ascii nocase
        $b = "two_factor" ascii nocase
        $c = "2fa" ascii nocase
        $d = "/manage/" ascii nocase
        $e = "not required" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or filesize < 2MB) and
        2 of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Weblate /manage/ Access Attempt Without 2FA (CVE-2026-61790)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/manage/"; http.cookie; content:"sessionid"; pcre:"/^\/manage\//Ui"; metadata:created_at 2026_06_01, updated_at 2026_06_01; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-61790; classtype:attempted-admin; sid:202661790; rev:1;)

Elastic Detection

any where event.module == "auditd" or process.name == "gunicorn"
| where event.action in ("user_login", "permission_check")
| where user.permissions.global == true
| where not user.two_factor_enabled
| filter data.stream == "weblate"

Splunk SPL Query

index=weblate sourcetype=weblate:access
| search "/manage/" OR event_action="permission_granted"
| where NOT two_factor_enabled="true" AND global_permission="true"
| stats count by src_ip, dest_host, user, uri
| lookup weblate_team_2fa_requirement user as user OUTPUT team_2fa_enforced, team_name
| where team_2fa_enforced="true"
| table _time, src_ip, user, team_name, uri, count
| rename team_name as "2FA-Enforcing Team", uri as "Requested URI"

Wazuh OSSEC Rule

<group name="weblate,">
  <rule id="571616" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">user_login</field>
    <field name="user.permissions.global">true</field>
    <field name="user.two_factor_enabled">false</field>
    <description>Weblate: user granted global permission without 2FA (CVE-2026-61790)</description>
    <group>access_control,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Upgrade Weblate to version 2026.7 or later as soon as it becomes available in your distribution channel; verify the vendor advisory before applying.
   • As an interim control, audit all teams with global permissions (site-wide scoped grants) and temporarily revoke any global permission from teams that enforce 2FA, until the upgrade is deployed.
   • Enforce an organizational policy that any account with global permissions must have 2FA enabled via external mechanisms (e.g., enforced through SSO/IdP), if the Weblate-native 2FA check is unreliable.
   • Restrict network access to the /manage/ interface via WAF rules or reverse-proxy access control lists to internal IP ranges only.

2. Patch/Upgrade Steps:

   • Back up the Weblate database and configuration.
   • Follow the standard Weblate upgrade procedure (stop services → run database migrations → upgrade application files → restart).
   • Confirm post-upgrade that version is 2026.7 (or higher) and validate that a 2FA-disabled user’s global permissions are correctly withheld.

3. Long-Term Hardening:

   • Implement automated CI/CD checks that scan Weblate release notes for security fixes; the vendor did not publish a standalone CNA advisory for this CVE (CNA title is empty), so rely on the NVD entry and release changelog.
   • Periodically audit team permission assignments, specifically verifying that 2FA-enforcing teams do not hold global permissions.
   • Enable comprehensive audit logging on the Weblate instance and feed logs to the detection rules listed above.
   • Monitor FIRST.org EPSS for scoring updates to reassess risk priority once the score becomes available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-61790
2. Weblate Official Website / Release Notes for version 2026.7: https://weblate.org/en/ (verify release notes page)
3. Weblate Documentation on Permissions and 2FA: https://docs.weblate.org/ (permission model reference)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no entry for CVE-2026-61790 as of report date)
5. CWE-284 Reference: https://cwe.mitre.org/data/definitions/284.html

Threat Actor Campaigns / In-the-Wild Exploitation: None known. The vulnerability is not listed in CISA KEV, no PoC or exploit code has been published, and no Nuclei template is available. Exploitation is theoretically feasible (as described in the Exploitation Scenarios) but has not been observed in the wild.