Weblate’s tasks API failed to enforce proper access control before version 5.17, allowing users to retrieve logs for in‑progress operations that they were not permitted to see. The weakness is a classic improper access control flaw, CWE‑284. An attacker can exploit the flaw by guessing the random UUID of a pending task; however, the API rate limits reduce the likelihood of a successful brute‑force attempt, so the practical risk is low, but the confidentiality of work is still at risk.

The affected product is Weblate, developed by the WeblateOrg community. All releases prior to 5.17 are vulnerable. The vulnerability was fixed in Weblate 5.17, which applies proper ACL checks against the owner and scope of pending tasks.

The CVSS score of 3.1 reflects a low‑severity impact. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. Exploitation requires brute‑forcing a UUID through the public API, a costly activity mitigated by rate limiting, so the true exploitation probability is low. Nevertheless, unauthorized users could still view sensitive logs if they manage to guess a task identifier.