Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.

CVE-2026-55228 affects Weblate, a web-based continuous localization platform for managing software translations. In versions prior to 2026.7, the REST API failed to properly enforce the scope of project- and workspace-scoped teams. This allowed authenticated users to submit invalid team configurations through the API, effectively assigning projects to teams without proper authorization checks. Exploiting this flaw could allow users to gain access to private projects they were not permitted to view or manage. The vulnerability could enable unauthorized translation, repository, and project-management operations beyond the user's intended permission scope. The issue has been resolved in Weblate version 2026.7, with a corresponding commit available on GitHub.