CVE-2026-77508

Executive Summary

CVE-2026-77508 is an authentication bypass vulnerability in Weblate, a web-based localization tool, affecting all versions prior to 2026.8. An authenticated user can alter the primary email address associated with their account via PUT or PATCH requests to /api/users/{username}/ without verification of the new address, enabling the acceptance of team invitations sent to that unverified address without possessing mailbox access. The vulnerability has a low CVSS score of 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) and is classified under CWE-302 (Authentication Bypass Using an Alternate Path or Channel). The primary impact is an integrity violation—an attacker can gain unauthorized membership in Weblate teams, potentially leading to unauthorized modifications of localization projects.

Technical Analysis

Vulnerability Class: CWE-302 — Authentication Bypass Using an Alternate Path or Channel. This class encompasses flaws where authentication is bypassed through an alternative mechanism that is weaker than the primary security control.

Affected Component: Weblate's user account management API endpoint, specifically the resource at /api/users/{username}/. This endpoint accepts both PUT and PATCH HTTP methods for updating user profile fields, including the primary email address.

Mechanism: The core flaw is the absence of email address verification on modification. When a standard email change is performed through the user interface, Weblate typically requires verification (e.g., a confirmation link sent to the new address). However, the REST API endpoint at /api/users/{username}/ allows an authenticated user to submit a PUT or PATCH request that alters the email field without triggering the verification workflow. The API trusts the submitted value as authoritative and updates the account record.

Attack Surface: The vulnerability is exposed over the network (AV:N) with low attack complexity (AC:L). The attacker requires valid low-privileged credentials (PR:L). Successful exploitation requires user interaction (UI:R) — specifically, a team administrator must invite the unverified email address. The scope is unchanged (S:U), and the impact is limited to integrity (I:L) with no impact on confidentiality or availability.

Technical Detail: Per the NVD description, the API contract accepts profile updates without performing an ownership or verification check on the email field. Consequently, the account is now associated with an email address the attacker does not control. When a team invitation is dispatched to that address, Weblate's invitation-acceptance logic validates only that the address matches an existing user account—not whether the requester has demonstrated control of the mailbox. The attacker, already logged in, can accept the invitation. The vulnerability is acknowledged to be fixed in Weblate version 2026.8, indicating the vendor identified and patched the flaw in the API validation layer.

Exploitation Scenarios

Preconditions:

• Valid authenticated account on a Weblate instance (any role, including translator).
• Target Weblate instance has team/invitation functionality enabled (standard feature).
• A team administrator or owner willing to send an invitation to the attacker-controlled (unverified) address.

Attack Chain (inferred from vulnerability class; no public PoC):

1. Reconnaissance/Target Identification: The attacker enumerates Weblate instances (e.g., via Shodan dorks for weblate login pages or API endpoints). They register a legitimate low-privilege account on the target instance. The attacker identifies a team of interest (e.g., a translation project with high-value strings or sensitive repositories).

2. Account Manipulation: The attacker sends a PUT or PATCH request to the endpoint /api/users/{attacker_username}/. The request body includes an updated email field set to an address chosen by the attacker (which they do not control). Because the API does not verify the address, the server accepts the change and updates the account's primary email. No confirmation email or token is sent.

3. Triggering Invitation: The attacker contacts a team administrator (social engineering, via any out-of-band channel — e.g., project forums, chat) and requests an invitation to that team, providing their new (unverified) email address. Alternatively, if the attacker has insider knowledge of the team's invite workflow, they may predict that an invitation will be sent. The administrator sends a team invitation to the attacker's unverified address.

4. Invitation Acceptance: The invitation email is delivered to the mailbox of the unverified address — which the attacker does not access. However, the acceptance mechanism in Weblate may be link-based with a token, OR it may rely solely on the user being logged in while the invitation is pending. Per the NVD description, the attacker can accept the invitation "without access to the intended recipient's mailbox." This implies the invitation acceptance endpoint validates the authenticated session's email against the invitation's target address — a check that now passes because the account's email has been changed.

5. Post-Exploitation Impact: The attacker gains membership in the target team. Depending on team permissions, this could grant rights to modify translation strings, approve/reject translations, manage glossary entries, or access project metadata. In environments where localization files are synced to source repositories or CDN, malicious translations could be injected into widely distributed products.

Impact Assessment

Business Impact: The primary impact is integrity loss. An attacker with team membership can manipulate localization content. For software vendors using Weblate to manage product translations, this could result in:

• Injection of malicious or offensive text into product UIs, damaging brand reputation.
• Subtle corruption of technical documentation (e.g., incorrect installation paths or security warnings) leading to user harm or support costs.
• Poisoning of translation memories, degrading future translation quality.

Affected Systems: Weblate instances — both self-hosted and those using the hosted weblate.org service (if still running pre-2026.8 versions) — running any version prior to 2026.8.

Blast Radius: CVSS base score 3.5 (Low). Impact is limited to integrity (I:L) with no confidentiality (C:N) or availability (A:N) impact. The attack requires low-privilege authentication (PR:L) and user interaction (UI:R), limiting automated large-scale exploitation. The scope is unchanged, meaning the compromise does not extend beyond the vulnerable component. However, the business consequences of unauthorized team membership in critical translation workflows should not be underestimated.

Detection Guidance

Sigma Rule

title: Weblite API Email Address Change Without Verification
id: 5c7e9a2f-0f3c-4b8d-9e1a-6f2c3b4a5d6e
status: experimental
description: Detects PUT/PATCH requests to Weblate user API endpoint that modify email without verification workflow
logsource:
    category: web
    product: weblate
detection:
    selection:
        cs-method:
            - 'PUT'
            - 'PATCH'
        cs-uri-path|startswith: '/api/users/'
        cs-uri-path|endswith: '/'
        cs-uri-query|contains: 'email'
    filter_known_ui:
        cs-uri-path|contains: '/api/users/'
        cs-uri-path|contains: '/password/'
    condition: selection and not filter_known_ui
level: medium
falsepositives:
    - Legitimate API usage where email verification is expected (admin scripts)
    - Bulk user management through API by admins
fields:
    - src_ip
    - cs-username
    - http_host

YARA Rule

rule Weblite_EmailBypass_API_Request
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP request patterns targeting Weblite user API for email manipulation"
        cve = "CVE-2026-77508"
        date = "2026-XX-XX"
    strings:
        $api_path = "/api/users/" ascii wide
        $http_method_put = "PUT" ascii wide
        $http_method_patch = "PATCH" ascii wide
        $email_field = "email" ascii wide
    condition:
        any of ($http_method*) and $api_path and $email_field
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77508 Weblite Email Bypass Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/api/users/"; http.uri; content:"email"; offset:0; depth:100; nocase; reference:cve,2026-77508; classtype:attempted-integrity-violation; sid:77050801; rev:1;)

Elastic Detection

sequence by http.request.body.content, source.ip
  [ network where http.request.method == "PUT" and http.request.body.content contains "email" ]
  [ network where http.request.method == "PATCH" and http.request.body.content contains "email" ]

Note: A more precise EQL rule should target the Weblate API path:

network where
  http.request.method in ("PUT", "PATCH")
  and http.request.uri like "/api/users/*"
  and http.request.body.content like "*\"email\"*"

Splunk SPL Query

index=web sourcetype=weblate
( method="PUT" OR method="PATCH" )
| where match(uri, "^/api/users/")
| where match(body, "email")
| table _time, clientip, user, uri, body
| stats count by clientip, user, uri

Wazuh OSSEC Rule

<rule id="770508" level="10">
  <decoded>json</decoded>
  <field name="method">PUT|PATCH</field>
  <field name="url">/api/users/</field>
  <field name="body" type="pcre2">email</field>
  <description>CVE-2026-77508: Weblite API email change without verification</description>
  <group>weblite,authentication_bypass,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from tracked sources). The vendor fix is stated in the NVD description as version 2026.8, but no official advisory or patch commit has been observed by vultersit.com intelligence sources at this time.

Immediate Mitigations (no vendor patch):

1. Restrict API access: Disable or firewall the /api/users/{username}/ endpoint. If API access is needed, restrict it to trusted IP ranges via reverse-proxy ACLs.
2. Disable email-based invitations: Temporarily disable team invitation functionality or require administrator approval for invitation acceptance.
3. Review account hygiene: Audit all user accounts for recent email changes made via API (check audit logs for /api/users/ PUT/PATCH requests).
4. Monitor alerts: Activate the detection rules provided above (Sigma, Suricata, Elastic, etc.) on all Weblate instances.
5. Re-verify admin accounts: Ensure administrative accounts are protected with strong passwords and MFA, as they are prime targets for this attack to reach team management functions.

Patch/Upgrade Steps:

1. When Weblate 2026.8 is released, upgrade immediately. Test in staging first.
2. Subscribe to Weblate security advisories (https://weblate.org)
3. Verify the patch is applied: check version string in the admin panel or via weblate --version.

Long-Term Hardening:

1. Enforce email verification: If the patched version introduces configurable settings for email verification, enable strict verification for all email changes (including API-driven).
2. Principle of least privilege: Grant API access only to service accounts with minimal roles. Disable API tokens for interactive users.
3. Harden invitation workflow: Require the invite-acceptance link to be clicked from a logged-in session where the email has been verified independently of the account field.
4. Regular security reviews: Audit Weblate configuration for any setting that weakens email verification or invitation security.
5. Network segmentation: Place Weblate behind a WAF that can inspect request bodies for anomalies in API payloads.

References

1. NVD Entry for CVE-2026-77508 — https://nvd.nist.gov/vuln/detail/CVE-2026-77508
2. Weblate official website (security advisories section) — https://weblate.org (advisory pending publication)
3. CWE-302 — Authentication Bypass Using an Alternate Path or Channel — https://cwe.mitre.org/data/definitions/302.html
4. MITRE ATT&CK Technique T1078 — Valid Accounts — https://attack.mitre.org/techniques/T1078/
5. Weblate documentation on API usage — https://docs.weblate.org/en/latest/api.html

Threat Actor Campaigns: As of this report, no known threat actor campaigns or exploit-in-the-wild evidence have been publicly reported. The vulnerability is not listed on CISA KEV. PoC status: None.