What is GHSA-m6hq-f4w9-qrjj?

GHSA-m6hq-f4w9-qrjj is a security advisory published by GitHub Security Advisories with Low severity. Weblate has improper validation upon invitation acceptance

Which CVE IDs does GHSA-m6hq-f4w9-qrjj cover?

GHSA-m6hq-f4w9-qrjj covers the following CVE IDs: CVE-2025-64725. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-m6hq-f4w9-qrjj?

GHSA-m6hq-f4w9-qrjj affects 1 product, including: pip/Weblate:\u003c 5.15.

GHSA-m6hq-f4w9-qrjjLow

Weblate has improper validation upon invitation acceptance

Vendor

GitHub Security Advisories

Published

December 15, 2025

Last Modified

December 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-64725 →

📋 Description

Impact

It was possible to accept an invitation opened by a different Weblate user.

Patches

https://github.com/WeblateOrg/weblate/pull/16913

Workarounds

Users should avoid leaving Weblate sessions with an unattended opened invitation.

References

Thanks to Nahid0x for responsibly disclosing this vulnerability to Weblate.

🎯 Affected products1

pip/Weblate:< 5.15

🔗 References (6)

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-m6hq-f4w9-qrjj
https://github.com/WeblateOrg/weblate/pull/16913
https://github.com/WeblateOrg/weblate/commit/02e904675f0608a6bbfbf9466eeccd9d022591e9
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15
https://nvd.nist.gov/vuln/detail/CVE-2025-64725
https://github.com/advisories/GHSA-m6hq-f4w9-qrjj