Vulnerability · Published Aug 26, 2026 · Assigned by GitHub_M

CVE-2026-77508Weblate: Unverified REST API email changes

Low 3.5

In plain English

A low-severity security flaw in weblate from WeblateOrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 82.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.

Affected products (as reported)

Vendor	Product	Versions
WeblateOrg	weblate	< 2026.8

Weakness: CWE-302, CWE-841 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-x84p-6892-473c x_refsource_CONFIRM
https://github.com/WeblateOrg/weblate/pull/20639 x_refsource_MISC