The translation memory API in Weblate enables developers and translators to store and retrieve translation suggestions across projects. Prior to version 5.17 the API exposed additional endpoints that omitted the required authorization checks. As a result, any authenticated user who could reach the endpoints could read or otherwise manipulate translation memory data, exposing potentially confidential translation strings and other sensitive information. This vulnerability is a missing authorization flaw, classified as CWE‑862.

The issue affects installations of Weblate running any version earlier than 5.17. The vendor is WeblateOrg, product Weblate. The fix was introduced in 5.17 and later releases. No specific scoped version list is provided beyond the threshold.

The CVSS score is 4.3, placing it in the low‑moderate range. No EPSS data is available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Because the affected endpoints are exposed over HTTP, the likely attack vector is remote over the network. An attacker who gains network connectivity to the Weblate instance could exploit the exposure, potentially revealing confidential translation memory data.