Weblate Private Translation Enumeration Vulnerability via API

A vulnerability in Weblate prior to version 5.17.1 allows for private translation enumeration through the screenshots, tasks, and component link APIs. This issue has been addressed in version 5.17.1.

Impact

Exploitation of this vulnerability could lead to unauthorized enumeration of translations in a project that are not accessible to the user.

Reproduction

The vulnerability can be reproduced by making requests to the screenshots API with a project or component that contains translations not accessible to the user. The API will return information about these translations, thereby allowing enumeration of private translation data.

Remediation

Users can upgrade to Weblate version 5.17.1 or later to address this vulnerability.