The vulnerability in Weblate’s REST API allows a user to retrieve every addon configuration in the system, regardless of their project membership or permissions. Because the AddonViewSet uses an unfiltered queryset, any authenticated user can issue GET requests to /api/addons/ and /api/addons/{id}/ to obtain confidential addon data. The exposure threatens privacy and could serve as groundwork for further exploitation, as addon configurations may reference sensitive environment variables or connection strings. This represents a medium severity information‑disclosure flaw (CWE‑200 and CWE‑862).

Weblate installations running any version prior to 5.16.1 are affected. This includes the default release series Weblate 5.15 and earlier, which developers and site administrators might still be using. Updating to Weblate 5.16.1 or later eliminates the problem, as the API is then correctly scoped to the current user’s permissions.

The CVSS v3 score of 4.3 indicates moderate risk. EPSS is less than 1%, meaning active exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack path is straightforward: an attacker merely needs to authenticate to the application or rely on a misconfigured REQUIRE_LOGIN setting to obtain any user credentials, then perform simple GET requests to the /api/addons/ endpoint. Although the low exploitation probability reduces urgency, the potential for widespread data leakage warrants prompt remediation.