Zukosdead

**Name of the Vulnerable Software and Affected Versions** Weblate versions prior to 2026.7 **Description** Weblate is a web-based continuous localization platform for managing software translations. A flaw exists where the requirement for members of a team to configure two-factor authentication (2FA) is not enforced for site-wide global permissions. While 2FA is correctly required for project-, component-, and workspace-scoped permissions, a user can still obtain and exercise global permissions without 2FA configured. This allows unauthorized access to global functions, including the site management interface at the '/manage/' endpoint. **Recommendations** Update to version 2026.7.