CVE-2026-33212

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.

• CWE-284

• https://github.com/WeblateOrg/weblate/commit/4e06b12cd05d087db68384e09d5f70fe883f2b70Patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vj45-x3pj-f4w4Mitigation, Patch, Vendor Advisory

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33207DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-33208Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…8.8
• CVE-2026-33209Avo is a framework to create admin panels for Ruby on Rails …6.1
• CVE-2026-3321A vulnerability of authorization bypass through user-control…8.7
• CVE-2026-33210Ruby JSON is a JSON implementation for Ruby. From version 2.…9.1
• CVE-2026-33211Tekton Pipelines project provides k8s-style resources for de…9.6
• CVE-2026-33213Redash is a package for data visualization and sharing. From…6.1
• CVE-2026-33214Weblate is a web based localization tool. In versions prior …4.3
• CVE-2026-33215NATS-Server is a High-Performance server for NATS.io, a clou…6.5
• CVE-2026-33216NATS-Server is a High-Performance server for NATS.io, a clou…7.5
• CVE-2026-33217NATS-Server is a High-Performance server for NATS.io, a clou…6.5
• CVE-2026-33218NATS-Server is a High-Performance server for NATS.io, a clou…7.5