SSRF Vulnerability in Weblate Localization Tool by Weblate
CVE-2026-39845

4.1MEDIUM

Key Information:

Vendor

Weblateorg

Status
Weblate
Vendor
CVE Published:
15 April 2026

What is CVE-2026-39845?

Weblate, a web-based localization tool, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability in its webhook add-on in versions prior to 5.17. This flaw allows for potential exploitation due to the lack of effective SSRF protections, which could enable attackers to send requests to internal services. To mitigate risks, users are advised to upgrade to version 5.17 or disable the webhook add-on until the update can be applied.

Affected Version(s)

weblate < 5.17

References

https://github.com/WeblateOrg/weblate/security/advisories...
x_refsource_CONFIRM
https://github.com/WeblateOrg/weblate/pull/18815
x_refsource_MISC

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.