Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rauj-hjbg-j7b4
Vulnerability ID VCID-rauj-hjbg-j7b4
Aliases CVE-2026-21889
GHSA-3g2f-4rjg-9385
Summary Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
Status Published
Exploitability 0.5
Weighted Severity 2.7
Risk 1.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2026-21889
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2026-21889
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2026-21889
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2026-21889
cvssv3.1_qr LOW https://github.com/advisories/GHSA-3g2f-4rjg-9385
cvssv4 2.3 https://github.com/WeblateOrg/weblate
generic_textual LOW https://github.com/WeblateOrg/weblate
cvssv4 2.3 https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47
generic_textual LOW https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47
ssvc Track https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47
cvssv4 2.3 https://github.com/WeblateOrg/weblate/pull/17516
generic_textual LOW https://github.com/WeblateOrg/weblate/pull/17516
ssvc Track https://github.com/WeblateOrg/weblate/pull/17516
cvssv3.1_qr LOW https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385
cvssv4 2.3 https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385
generic_textual LOW https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385
ssvc Track https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385
cvssv4 2.3 https://nvd.nist.gov/vuln/detail/CVE-2026-21889
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2026-21889
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-21889
https://github.com/WeblateOrg/weblate
17516 https://github.com/WeblateOrg/weblate/pull/17516
a6eb5fd0299780eca286be8ff187dc2d10feec47 https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47
CVE-2026-21889 https://nvd.nist.gov/vuln/detail/CVE-2026-21889
GHSA-3g2f-4rjg-9385 https://github.com/advisories/GHSA-3g2f-4rjg-9385
GHSA-3g2f-4rjg-9385 https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-14T16:58:27Z/ Found at https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/pull/17516
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-14T16:58:27Z/ Found at https://github.com/WeblateOrg/weblate/pull/17516
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-14T16:58:27Z/ Found at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-21889
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.0872
EPSS Score 0.00029
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:47:00.339369+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/21xxx/CVE-2026-21889.json 38.6.0