The vulnerability resides in the user patching API endpoint of Weblate, a web‑based localization platform provided by WeblateOrg. Prior to version 5.17 the endpoint did not correctly enforce scope limits, enabling a user to modify data beyond the intended boundaries. This flaw allows an attacker with API access to elevate privileges and potentially alter translation content or user configurations that should be protected, compromising the integrity of the platform. The flaw is identified as CWE‑269.

Weblate, a web‑based localization tool from WeblateOrg, is impacted. Any installation using Weblate prior to the 5.17 release is vulnerable, regardless of deployment environment. The issue was corrected in the 5.17 update.

The CVSS score of 8.8 indicates a high severity level. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting no publicly known exploits at this time. The likely attack vector is through authenticated use of the API; an attacker that can authenticate to the Weblate instance can craft requests to the patching endpoint to gain unauthorized modification rights. No other special conditions are noted in the description, so any authenticated user who has API access is at potential risk until the issue is patched or mitigated.