THREAT OPS › Threat News › [GHSA] GHSA-2q2q-jr9g-v9rf (high) — Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
[GHSA] GHSA-2q2q-jr9g-v9rf (high) — Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
GHSA-2q2q-jr9g-v9rf Severity: high CVE: CVE-2026-55228
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
### Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.
### Patches * https://g
Indicators of compromise
- CVE-2026-55228cve
- https://hackerone.com/imhegourl
- https://hackerone.com/v01demorturl
- https://hackerone.com/b4nderurl
Original source: https://github.com/advisories/GHSA-2q2q-jr9g-v9rf