CVE-2026-33214 MEDIUM

CVE-2026-33214: Weblate has improper access control for the translation memory API

Vendor Weblateorg
Product weblate
Weakness CWE-862 · Missing authorization
Published April 15, 2026
Last update April 15, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.

Key dates

02Disclosure timeline

April 15, 2026 CVE published
April 15, 2026 Record updated