CVE-2025-67715

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-25)

CWEs

CWE-284, CWE-285

Published

2025-12-16

Modified

2026-10-07

Record from

the NVD, synced 2026-10-19

Affected

• weblate:weblate

Packages (OSV)

References

• https://github.com/WeblateOrg/weblate/pull/17256
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3pmh-24wp-xpf4

Check your stackJSON