Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-am2b-ejeh-n3gt
Vulnerability ID VCID-am2b-ejeh-n3gt
Aliases CVE-2026-44263
GHSA-gcg5-86jr-f7jg
Summary Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-203 Observable Discrepancy
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-44263
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-gcg5-86jr-f7jg
cvssv3.1 4.3 https://github.com/WeblateOrg/weblate
generic_textual MODERATE https://github.com/WeblateOrg/weblate
cvssv3.1 4.3 https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203
generic_textual MODERATE https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203
ssvc Track https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203
cvssv3.1 4.3 https://github.com/WeblateOrg/weblate/pull/19258
generic_textual MODERATE https://github.com/WeblateOrg/weblate/pull/19258
ssvc Track https://github.com/WeblateOrg/weblate/pull/19258
cvssv3.1 4.3 https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
generic_textual MODERATE https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
ssvc Track https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
cvssv3.1 4.3 https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg
cvssv3.1_qr MODERATE https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg
generic_textual MODERATE https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg
ssvc Track https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2026-44263
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-44263
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-44263
https://github.com/WeblateOrg/weblate
https://nvd.nist.gov/vuln/detail/CVE-2026-44263
19258 https://github.com/WeblateOrg/weblate/pull/19258
6cf892c7bd50b667a65a99d716a90694f7d9f203 https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203
GHSA-gcg5-86jr-f7jg https://github.com/advisories/GHSA-gcg5-86jr-f7jg
GHSA-gcg5-86jr-f7jg https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg
weblate-5.17.1 https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/WeblateOrg/weblate
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-07T14:59:57Z/ Found at https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/WeblateOrg/weblate/pull/19258
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-07T14:59:57Z/ Found at https://github.com/WeblateOrg/weblate/pull/19258
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-07T14:59:57Z/ Found at https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-07T14:59:57Z/ Found at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-44263
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01345
EPSS Score 0.00011
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:42:44.795690+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/44xxx/CVE-2026-44263.json 38.6.0