CVE-2025-64725
📋 TL;DR
This vulnerability in Weblate allows one user to accept an invitation that was opened by another user, potentially leading to unauthorized access or privilege escalation. All Weblate instances running versions before 5.15 are affected. The issue stems from improper invitation session handling.
💻 Affected Systems
- Weblate
📦 What is this software?
Weblate by Weblate
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain unauthorized access to projects, modify translations, or escalate privileges by hijacking another user's invitation session.
Likely Case
Unauthorized users gaining access to projects they shouldn't have access to, potentially leading to data manipulation or exposure.
If Mitigated
With proper session management controls and monitoring, impact is limited to potential unauthorized project access without further escalation.
🎯 Exploit Status
Exploitation requires access to Weblate instance and knowledge of invitation sessions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.15
Vendor Advisory: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-m6hq-f4w9-qrjj
Restart Required: Yes
Instructions:
1. Backup your Weblate instance. 2. Update to Weblate 5.15 or later using your package manager or pip. 3. Restart Weblate services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Session Management Workaround
allAvoid leaving Weblate sessions with open invitations unattended
🧯 If You Can't Patch
- Implement strict session timeout policies for Weblate users
- Monitor for unusual invitation acceptance patterns in logs
🔍 How to Verify
Check if Vulnerable:
Check Weblate version via admin interface or by running 'weblate --version' commandCheck Version:
weblate --versionVerify Fix Applied:
Verify version is 5.15 or higher and test invitation acceptance functionality📡 Detection & Monitoring
Log Indicators:
- Multiple invitation acceptances from different user sessions
- Unusual invitation acceptance patterns
Network Indicators:
- Multiple invitation-related requests from different IPs in short timeframe
SIEM Query:
source="weblate" AND (event="invitation_accepted" OR event="project_access_granted") | stats count by user, src_ip