Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
Date: 2025-12
Affected: pip/Weblate
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-67715
CWE: CWE-284
CWE-285
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

### Impact It was possible to retrieve user notification settings or list all users via API. ### Patches * https://github.com/WeblateOrg/weblate/pull/17256 ### References Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to Weblate.


Mitigations:

Architectural layers (MAESTRO):