CVE-2026-62364

LOW 2.3

wlc may disclose API tokens to project-configured URLs

CVSS Score

2.3

EPSS Score

0.0%

EPSS Percentile

0th

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.

CWE	CWE-200 CWE-349
Vendor	weblateorg
Product	wlc
Published	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for weblateorg wlc

Be the first to know when new low vulnerabilities affecting weblateorg wlc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

WeblateOrg / wlc

< 2.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WeblateOrg/wlc/security/advisories/GHSA-3mqq-hv9c-85hc github.com: https://github.com/WeblateOrg/wlc/pull/1500 github.com: https://github.com/WeblateOrg/wlc/commit/15cbdfc5b2c6183ef6864ea758091643a0ce6c89 github.com: https://github.com/WeblateOrg/wlc/releases/tag/2.0.1