Weblate Translation Memory API Access Control Vulnerability

A vulnerability exists in Weblate, a web-based localization tool, in versions prior to 5.17. The issue arises from the translation memory API, which exposed unintended endpoints without proper access control. This flaw could potentially allow unauthorized access to certain data or functionalities. The vulnerability has been addressed in version 5.17. For users unable to update immediately, the CDN add-on, which enables this feature, can be disabled as it is not activated by default.

Impact

Exploitation of this vulnerability could lead to unauthorized access to translation memory data, allowing for arbitrary local file reads outside the repository, according to GitHub.

Remediation

Users can update to Weblate version 5.17 to address this vulnerability. If an immediate update is not possible, the CDN add-on can be disabled, as it is not enabled by default.