CVE-2026-27457

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.

• CWE-200
• CWE-862
• CWE-862

• https://github.com/WeblateOrg/weblate/commit/3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9Patch
• https://github.com/WeblateOrg/weblate/commit/7802c9b121eb407c48d4adddd4f2458fb3efef0fPatch
• https://github.com/WeblateOrg/weblate/pull/18107Issue Tracking, Patch
• https://github.com/WeblateOrg/weblate/pull/18164Issue Tracking, Patch
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.16.1Product, Release Notes
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-wppc-7cq7-cgfvPatch, Vendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27448pyOpenSSL is a Python wrapper around the OpenSSL library. St…5.3
• CVE-2026-27449Umbraco Engage is a business intelligence platform. A vulner…7.5
• CVE-2026-2745GitLab has remediated an issue in GitLab CE/EE affecting all…8.1
• CVE-2026-27452ASN.1 TypeScript ESM library, including codecs for Basic Enc…5.3
• CVE-2026-27454Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2026-27456util-linux is a random collection of Linux utilities. Prior …4.7
• CVE-2026-27458LinkAce is a self-hosted archive to collect website links. V…5.4
• CVE-2026-27459pyOpenSSL is a Python wrapper around the OpenSSL library. St…9.8
• CVE-2026-2746SEPPmail Secure Email Gateway before version 15.0.1 does not…5.3
• CVE-2026-27460Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-27461Pimcore is an Open Source Data & Experience Management Platf…4.9
• CVE-2026-27464Metabase is an open-source data analytics platform. In versi…6.5