CVE-2025-67715 — Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

CVE-2025-67715

Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) PUBLISHED

Description (CNA)

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

Affected (CNA)

Vendor / product	Versions
WeblateOrg / weblate	affected < 5.15

CWE

CWE-284, CWE-285

References

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3pmh-24wp-xpf4
https://github.com/WeblateOrg/weblate/pull/17256

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.