CVE-2026-33220

The core impact of CVE-2026-33220 lies in the exposure of Weblate's translation memory API endpoints without adequate access control mechanisms. An attacker could exploit this to potentially retrieve or manipulate translation data, including potentially sensitive content managed within Weblate projects. The extent of the data at risk depends on the specific data stored within the translation memories. While the description doesn't explicitly mention lateral movement, successful exploitation could lead to unauthorized access to other systems if Weblate is integrated with other services or if the attacker gains credentials through the exposed API.

Organizations using Weblate for translation management, particularly those with sensitive content stored within translation memories, are at risk. This includes teams relying on Weblate for software localization, documentation translation, or other content translation workflows. Those using older Weblate instances (0.0.0 - 5.16) are particularly vulnerable.

• python / server:

# Check for Weblate version
python3 -c 'import weblate; print(weblate.__version__)'

• generic web:

# Check for exposed API endpoints (example)
curl -I https://your-weblate-instance/api/tm/  # Look for 200 OK responses without authentication

1. 2026-04-15Disclosure

   disclosure

1. आरक्षित2026-03-17
2. प्रकाशित2026-04-15
3. संशोधित2026-04-16
4. EPSS अद्यतन2026-04-23

The primary mitigation for CVE-2026-33220 is to upgrade Weblate to version 5.17.0 or later, which includes the necessary access control fixes. If an immediate upgrade is not feasible, consider enabling the CDN add-on, which is not enabled by default and can provide an additional layer of protection. Review Weblate's access control configuration to ensure that only authorized users have access to translation memories. After upgrading, confirm the fix by attempting to access the exposed API endpoints with unauthorized credentials and verifying that access is denied.