CVE-2026-55228: Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

August 28, 2026

The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.

References

github.com/WeblateOrg/weblate/commit/19babc99b05f2cc299b5090f90f79d8181f25d79
github.com/WeblateOrg/weblate/pull/19970
github.com/WeblateOrg/weblate/security/advisories/GHSA-2q2q-jr9g-v9rf
github.com/advisories/GHSA-2q2q-jr9g-v9rf
nvd.nist.gov/vuln/detail/CVE-2026-55228

Code Behaviors & Features

Detect and mitigate CVE-2026-55228 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →