Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

CVE-2025-67715

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-3pmh-24wp-xpf4

Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) ### Impact It was possible to retrieve user notification settings or list all users via API. ### Patches * https://github.com/WeblateOrg/weblate/pull/17256 ### References Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to Weblate.

gitlab/pypi/Weblate/CVE-2025-67715

Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) It was possible to retrieve user notification settings or list all users via API.

pypa/weblate/PYSEC-2025-233

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

pysec/PYSEC-2025-233

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.