H3Xv0Rt3X

**Name of the Vulnerable Software and Affected Versions** Weblate versions prior to 2026.7 **Description** The REST API fails to properly enforce the scope of project- and workspace-scoped teams. This allows a user to submit invalid team configurations, enabling them to assign projects to a team via unvalidated requests. Consequently, a user could grant themselves access to projects they are not authorized to see or manage, potentially exposing private projects and allowing unauthorized translation, repository, and project-management operations. **Recommendations** Update to version 2026.7.