What is CVE-2026-77508?

CVE-2026-77508 is a low-severity vulnerability in Weblateorg Weblate, classified under Authentication Bypass by Assumed-Immutable Data. CVSS score: 3.5/10. Published 2026-08-26.

How severe is CVE-2026-77508?

Low severity. CVSS v3 base score is 3.5 out of 10.

Vulnerability in Weblateorg Weblate

CVE-2026-77508

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.

Affected products

Weblateorg Weblate — versions < 2026.8

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-77508?: CVE-2026-77508 is a low-severity vulnerability in Weblateorg Weblate, classified under Authentication Bypass by Assumed-Immutable Data. CVSS score: 3.5/10. Published 2026-08-26.
How severe is CVE-2026-77508?: Low severity. CVSS v3 base score is 3.5 out of 10.