What is GHSA-2q2q-jr9g-v9rf?

GHSA-2q2q-jr9g-v9rf is a security advisory published by GitHub Security Advisories with High severity. Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

Which CVE IDs does GHSA-2q2q-jr9g-v9rf cover?

GHSA-2q2q-jr9g-v9rf covers the following CVE IDs: CVE-2026-55228. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2q2q-jr9g-v9rf?

GHSA-2q2q-jr9g-v9rf has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-2q2q-jr9g-v9rf?

GHSA-2q2q-jr9g-v9rf affects 1 product, including: pip/Weblate:\u003c 2026.7.

GHSA-2q2q-jr9g-v9rfHighCVSS 8.1

Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-55228 →

📋 Description

Impact

The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.

Patches

https://github.com/WeblateOrg/weblate/pull/19970

References

Parts of this issue were independently reported by four reporters:

@H3xV0rT3x via GitHub
imhego via HackerOne
v01demort via HackerOne
b4nder via HackerOne

🎯 Affected products1

pip/Weblate:< 2026.7

🔗 References (5)

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-2q2q-jr9g-v9rf
https://nvd.nist.gov/vuln/detail/CVE-2026-55228
https://github.com/WeblateOrg/weblate/pull/19970
https://github.com/WeblateOrg/weblate/commit/19babc99b05f2cc299b5090f90f79d8181f25d79
https://github.com/advisories/GHSA-2q2q-jr9g-v9rf