GHSA-gcg5-86jr-f7jg

Weblate Vulnerable to Private Translation Enumeration via Screenshot API

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-44263

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	weblate	< 5.17.1	5.17.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. ### Patches * https://github.com/WeblateOrg/weblate/pull/19258 ### Acknowledgement Weblate thanks Luay for reporting this vulnerability according to the organization's [security issues guideline](https://docs.weblate.org/en/latest/security/issues.html).

References

External links from the advisory. They lead to third-party sites.

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg web
https://nvd.nist.gov/vuln/detail/CVE-2026-44263 advisory
https://github.com/WeblateOrg/weblate/pull/19258 web
https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203 web
https://github.com/WeblateOrg/weblate package
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1 web