Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-50127

Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:8198952d68f3df81f089ee67979ea01ac7dcc0fa3493f1f4ea5328bb60dfc1fa
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"weblate","vendor":"WeblateOrg","versions":[{"status":"affected","version":">= 5.15, < 2026.6"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2d1752c9dc978ed08424b3543839b2aecee5dbec6dd7517e19a9d6d5938e91e6 · sha256:861901e7c6a566da… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d1752c9dc978ed08424b3543839b2aecee5dbec6dd7517e19a9d6d5938e91e6 · sha256:861901e7c6a566da… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:2d1752c9dc978ed08424b3543839b2aecee5dbec6dd7517e19a9d6d5938e91e6 · sha256:861901e7c6a566da… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/WeblateOrg/weblate/pull/19768","tags":["x_refsource_MISC"],"url":"https://github.com/WeblateOrg/weblate/pull/19768"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d1752c9dc978ed08424b3543839b2aecee5dbec6dd7517e19a9d6d5938e91e6 · sha256:861901e7c6a566da… · /containers/cna/references/1
{"name":"https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6","tags":["x_refsource_MISC"],"url":"https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d1752c9dc978ed08424b3543839b2aecee5dbec6dd7517e19a9d6d5938e91e6 · sha256:861901e7c6a566da… · /containers/cna/references/2
{"name":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45","tags":["x_refsource_CONFIRM"],"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d1752c9dc978ed08424b3543839b2aecee5dbec6dd7517e19a9d6d5938e91e6 · sha256:861901e7c6a566da… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer