CVE-2026-55228: Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

August 28, 2026

The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.

References

github.com/WeblateOrg/weblate/commit/19babc99b05f2cc299b5090f90f79d8181f25d79
github.com/WeblateOrg/weblate/pull/19970
github.com/WeblateOrg/weblate/security/advisories/GHSA-2q2q-jr9g-v9rf
github.com/advisories/GHSA-2q2q-jr9g-v9rf
nvd.nist.gov/vuln/detail/CVE-2026-55228

Code Behaviors & Features

Detect and mitigate CVE-2026-55228 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →