The vulnerability resides in the Weblate command‑line client, wlc, which allows unscoped API keys to be configured. Unscoped keys are discouraged, but the code path remained present, enabling the key to be unintentionally forwarded to or observed by other servers. Exposure of an API key grants an attacker full API privileges, potentially allowing them to read, modify, or delete data in the Weblate instance. The weakness is identified as a confidentiality violation.

Manufactured by WeblateOrg, the wlc client, versions prior to 1.17.0, contains this flaw. The affected packages are the command‑line client ‘wlc’ and any instance that relies on it to interact with Weblate’s REST API.

The CVSS score of 5.3 places the issue in the moderate range, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The flaw is not listed in the CISA Kennedylike Vulnerabilities catalog. The likely attack vector is misuse or misconfiguration of API keys within the client or inadvertent leakage to intermediate servers during API requests. Exploitation would require the attacker to obtain the leaked key, after which they could gain unauthorized access to the API endpoints.