CVE-2025-64326 - CVE House
Back to Database
Status published Low CVE-2025-64326

Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log

Vulnerability Description

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64326

Credits & Attribution

No credits recorded in the NVD database.

References

More from WeblateOrg

View All →
CVE-2025-68398
Weblate has git config file overwrite vulnerability that leads to remote code execution
Critical 9.1
CVE-2025-68279
Weblate has an arbitrary file read via symbolic links
High 7.7
CVE-2025-67715
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
Medium 4.3
CVE-2025-67492
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
Medium 5.3
CVE-2025-66407
Weblate has Server-Side Request Forgery vulnerability
Medium 5

Affected Vendor

Affected Software

weblate
Vulnerable Versions:
< 5.14.1

Timeline

Official Publish: November 6th, 2025
Last Modified: November 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-212

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.