CVE-2026-61790

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7

Description Weblate is a web-based continuous localization platform for managing software translations. A flaw exists where the requirement for members of a team to configure two-factor authentication (2FA) is not enforced for site-wide global permissions. While 2FA is correctly required for project-, component-, and workspace-scoped permissions, a user can still obtain and exercise global permissions without 2FA configured. This allows unauthorized access to global functions, including the site management interface at the '/manage/' endpoint.

Recommendations Update to version 2026.7.