Weblate Webhook Payload Vulnerability Allowing Unauthorized Repository Updates

A vulnerability in Weblate, a web-based localization tool, allows for unauthorized repository updates via a crafted webhook payload. This issue affects Weblate versions prior to 5.15. The vulnerability arises from an over-permissive webhook endpoint that enables mass repository updates and component enumeration. Exploitation of this vulnerability does not require any privileges, user interaction, or special attack vectors.

Impact

Exploitation of this vulnerability could lead to unauthorized updates of multiple repositories, potentially allowing for malicious changes to be introduced across these repositories.

Remediation

Users can update to Weblate version 5.15, where this vulnerability has been patched. Alternatively, webhooks can be disabled completely using the ENABLE_HOOKS option to avoid this vulnerability.