VulnerabilityAnalyzed

CVE-2026-21889

This could allow an unauthenticated user to access screenshots after guessing their filename.

LOW 2.3EPSS 0.38%

Does this matter?

Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own.

Description

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.38% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: weblate/weblate
Source: security-advisories@github.com

References

https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47Patch
https://github.com/WeblateOrg/weblate/pull/17516Issue Tracking
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.