CVE-2026-21889

Weblate leaks information via screenshots

Low2.3EPSS 0.39%

Published: 14 Jan 2026
Updated: 14 Jan 2026
Reserved: 5 Jan 2026
Assigned by: GitHub_M

Description

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

Scores

CVSS scores of CVE-2026-21889, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	4.0	Low2.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
NVDNVD · Analyzed	4.0	Low2.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.39% · top 67% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.3.

Weakness

CWE-284: Improper Access Control (opens in a new tab)All about CWE-284 and its CVEs

Affected products

WeblateOrg · weblate
- affected < 5.15.2

Affected packages

From reviewed advisories of the GitHub Advisory Database.

PyPIweblateGHSA-3g2f-4rjg-9385 (opens in a new tab)

References (3)

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385 (opens in a new tab)x_refsource_CONFIRM
https://github.com/WeblateOrg/weblate/pull/17516 (opens in a new tab)x_refsource_MISC
https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-21889](https://trackcve.app/badge/CVE-2026-21889.svg)](https://trackcve.app/cve/CVE-2026-21889)

Record last updated 14 Jan 2026, 16:58 UTC.