CVE-2026-33212 Weblate: Improper access control for pending tasks in API

Low 3.1 Published 15 Apr 2026 Updated 15 Apr 2026

Attackers can read logs of in-progress operations for tasks they lack access to by brute-forcing task UUIDs in the Weblate API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-33212?

CVE-2026-33212 is a low-severity missing authorization vulnerability in WeblateOrg weblate, published on 15 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.

Weakness: CWE-284

Which versions are affected by CVE-2026-33212?

3 open source packages ship an affected version, including weblate. It affects 1 product.

Package	Affected	Fixed in
`weblate` PyPI	All versions	`5.17`
`weblate` PyPI	All versions	`5.17`
`weblate` PyPI	All versions	`5.17`

Products include Weblate Weblate.

How do I fix CVE-2026-33212?

Upgrade weblate to 5.17 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33212 being exploited?

There is no known exploitation of CVE-2026-33212 in the wild and no public exploit code.

Sources

Also known as GHSA-vj45-x3pj-f4w4, PYSEC-2026-2311.