Endpoints in Weblate perform object lookups without restricting them to projects the user can view. When a user requests an object that exists but the user lacks permission, the system returns HTTP 403 instead of the expected 404. The difference in status codes allows an unauthenticated or unauthorized user to deduce whether a given object exists within a private project. This is a classic information‑exposure weakness (CWE‑203).

The affected product is Weblate from WeblateOrg. All releases prior to version 2026.7 are vulnerable; the problem has been fixed in 2026.7 and later.

Based on the description, it is inferred that an attacker can exploit the vulnerability by sending HTTP requests to Weblate endpoints that perform global object lookups. The CVSS base score is 4.3, indicating moderate severity. Based on the description, it is inferred that authentication is not explicitly required, and the attacker must know or guess an object identifier. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of public exploitation is not well quantified, but the status code leakage provides a useful information‑gathering tool for attackers.