GHSA-3382-gw9x-477v

Weblate: Privilege escalation in the user API endpoint

Source: GitHub Advisory Database (reviewed) High CVE-2026-34393

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Weblate	< 5.17	5.17

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The user patching API endpoint didn't properly limit the scope of edits. ### Patches * https://github.com/WeblateOrg/weblate/pull/18687 ### References Thanks to @tikket1 and @DavidCarliez for reporting this via GitHub. We received two individual reports for this.

References

External links from the advisory. They lead to third-party sites.

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3382-gw9x-477v web
https://nvd.nist.gov/vuln/detail/CVE-2026-34393 advisory
https://github.com/WeblateOrg/weblate/pull/18687 web
https://github.com/WeblateOrg/weblate package
https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-155.yaml web