CVE-2026-77508

Summary

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.

Affected Software

VendorProductVersion RangeStatus
WeblateOrgweblate< 2026.8affected

Weaknesses

  • CWE-302: CWE-302: Authentication Bypass by Assumed-Immutable Data
  • CWE-841: CWE-841: Improper Enforcement of Behavioral Workflow

References