CVE-2026-21889
Last modified
CVE-2026-21889 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Weblate | Weblate | < 5.15.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-21889?
How severe is CVE-2026-21889?
How do I fix CVE-2026-21889?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-21883Bokeh is an interactive visualization library written in Pyt…5.4
- CVE-2026-21884React Router is a router for React. In @remix-run/react vers…8.2
- CVE-2026-21885Miniflux 2 is an open source feed reader. Prior to version 2…6.5
- CVE-2026-21886OpenCTI is an open source platform for managing cyber threat…8.1
- CVE-2026-21887OpenCTI is an open source platform for managing cyber threat…7.7
- CVE-2026-21888NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
- CVE-2026-2189A vulnerability was identified in itsourcecode School Manage…9.8
- CVE-2026-21891ZimaOS is a fork of CasaOS, an operating system for Zima dev…9.8
- CVE-2026-21892Parsl is a Python parallel scripting library. A SQL Injectio…7.3
- CVE-2026-21893n8n is an open source workflow automation platform. From ver…7.2
- CVE-2026-21894n8n is an open source workflow automation platform. In versi…6.5
- CVE-2026-21895The `rsa` crate is an RSA implementation written in rust. Pr…5.3
Are you affected by CVE-2026-21889?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST