Weblate Improper Access Control Vulnerability in Tasks API

A vulnerability exists in Weblate versions prior to 5.17, where the tasks API failed to properly verify user access for pending tasks. This oversight could allow users to access logs of ongoing operations that are outside their permitted scope. Although the vulnerability requires brute-forcing the random UUID of the task, making exploitation unlikely under normal API rate limits, it still poses a risk of exposing sensitive information.

Impact

The vulnerability could lead to unauthorized access to logs of in-progress operations, potentially allowing users to view sensitive information related to tasks they do not have permission to access.

Remediation

Users can upgrade to Weblate version 5.17 or later to address this vulnerability.