CVE-2026-44263

MEDIUM 4.3

Weblate: Private Translation Enumeration via Screenshot API

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.

CWE	CWE-203
Vendor	weblateorg
Product	weblate
Published	May 7, 2026
Last Updated	May 7, 2026

Stay Ahead of the Next One

Get instant alerts for weblateorg weblate

Be the first to know when new medium vulnerabilities affecting weblateorg weblate are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

WeblateOrg / weblate

< 5.17.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg github.com: https://github.com/WeblateOrg/weblate/pull/19258 github.com: https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203 github.com: https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1