MEDIUMPyPI →
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
Affected packages
- weblate— before 2026.7
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2p9g-x3cv-5hh4
- https://nvd.nist.gov/vuln/detail/CVE-2026-55227
- https://github.com/WeblateOrg/weblate/pull/19971
- https://github.com/WeblateOrg/weblate/commit/836bc082803d49d02f2831ec8339268eb66bcdae
- https://github.com/WeblateOrg/weblate
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.7
Structured record: https://osv.dev/vulnerability/GHSA-2p9g-x3cv-5hh4
Recommended response stack
Snyk — Scan your dependencies in CI and fix this vulnerability.→Socket — Detect malicious and compromised packages before they ship.→
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta