GHSA-pj86-258h-qrvf: Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

Skip to content

Navigation Menu

• • AI CODE CREATION

    • GitHub CopilotWrite better code with AI

    • GitHub SparkBuild and deploy intelligent apps

    • GitHub ModelsManage and compare prompts

    • MCP RegistryNewIntegrate external tools

View all features

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

Appearance settings

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2025-67492

Weblate’s over‑permissive webhook endpoint enables mass repository updates and component enumeration

Moderate severity GitHub Reviewed Published Dec 15, 2025 in WeblateOrg/weblate • Updated Dec 15, 2025

Package

pip Weblate (pip)

Description

Impact

It was possible to trigger repository updates for many repositories via a crafted webhook payload.

Patches

• WeblateOrg/weblate#17221

Workarounds

Disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.

References

Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.

References

• GHSA-pj86-258h-qrvf
• WeblateOrg/weblate#17221

Published to the GitHub Advisory Database

Dec 15, 2025

Last updated

Dec 15, 2025

EPSS score