CVE-2026-77508 — Weblate: Unverified REST API email changes
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ w…
Published: 2026-08-26 · CVSS: 3.5 · CVSS 3.1
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7