CVE-2026-34393
Published: 15 April 2026
Summary
CVE-2026-34393 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Weblate Weblate. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-34393 is a vulnerability in Weblate, a web-based localization tool, affecting versions prior to 5.17. The issue lies in the user patching API endpoint, which fails to properly limit the scope of edits. This improper privilege management flaw, mapped to CWE-269, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by a low-privileged authenticated user (PR:L) over the network (AV:N) with low attack complexity and no user interaction required. Exploitation allows the attacker to perform edits beyond their authorized scope, resulting in high impacts on confidentiality, integrity, and availability.
Weblate has addressed this issue in version 5.17. Additional details are available in the GitHub security advisory at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3382-gw9x-477v and the fixing pull request at https://github.com/WeblateOrg/weblate/pull/18687.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23005
Vulnerability details
Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The improper privilege management flaw in the user patching API endpoint allows low-privileged authenticated users to perform unauthorized edits, directly enabling exploitation for privilege escalation (T1068) and account manipulation (T1098).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly mitigating the failure to limit edit scope in the user patching API endpoint.
Employs least privilege to restrict low-privileged users from performing edits beyond their authorized scope, addressing the improper privilege management flaw.
Validates inputs to the patching API endpoint to ensure edit scopes align with user privileges, providing an additional layer against unauthorized modifications.