Low severityNVD Advisory· Published Nov 6, 2025· Updated Nov 6, 2025
Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log
CVE-2025-64326
Description
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
weblatePyPI | < 5.14.1 | 5.14.1 |
Affected products
3- ghsa-coords2 versions
< 5.14.1+ 1 more
- (no CPE)range: < 5.14.1
- (no CPE)range: < 5.14.3-1.1
- Range: < 5.14.1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-gr35-vpx2-qxhcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-64326ghsaADVISORY
- github.com/WeblateOrg/weblate/commit/b847e9756a0a6f7659ef20fa9f34846ca862c574ghsaWEB
- github.com/WeblateOrg/weblate/pull/16781ghsax_refsource_MISCWEB
- github.com/WeblateOrg/weblate/security/advisories/GHSA-gr35-vpx2-qxhcghsax_refsource_CONFIRMWEB
- github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2025-230.yamlghsaWEB
News mentions
0No linked articles in our index yet.