Medium severity5.9NVD Advisory· Published Jun 10, 2026· Updated Jun 10, 2026

CVE-2026-50127

Description

Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Weblateorg/Weblatereferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: >=5.15 <2026.6
osv-coords
pkg:rpm/opensuse/weblate&distro=openSUSE%20Tumbleweed
Range: < 5.17.1-2.1

Patches

Vulnerability mechanics

References

github.com/WeblateOrg/weblate/pull/19768nvd
github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6nvd
github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45nvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000