GHSA-9rp8-h4g8-8766

Weblate wlc has insecure API key configuration

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-22251

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	wlc	< 1.17.0	1.17.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server. ### Patches * https://github.com/WeblateOrg/wlc/pull/1098 ### Workarounds Remove unscoped `key` from wlc configuration. Only use URL-scoped keys in the `[keys]` sections. ### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.

References

External links from the advisory. They lead to third-party sites.

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766 web
https://nvd.nist.gov/vuln/detail/CVE-2026-22251 advisory
https://github.com/WeblateOrg/wlc/pull/1098 web
https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797 web
https://github.com/WeblateOrg/wlc package