Dashboard / CVE-2026-33220

CVE-2026-33220

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 54/100
Published: 2026-04-15 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Required
S: Changed
C: High
I: None
A: None

Description

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
weblate weblate < 5.17

References & Advisories (2)

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

6.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

EPSS — Exploitation Probability

0.32%
Raw Score 0.003230
Percentile 25.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00323
2026-10-28
0.00323

Intelligence Sources

nvd ref →

External Links