The wlc command‑line client automatically discovers configuration files such as .weblate or weblate.ini, which may contain the API URL and the unscoped token set in WLC_KEY or via --key. When these files are processed in an untrusted repository or pull‑request checkout, the client can send the exposed token to a project‑configured URL. The primary impact is credential exposure that lets an attacker obtain full read and write access to the Weblate platform through the REST API. This vulnerability is represented by CWE‐200 (Information Exposure) and CWE‐349 (Open Redirect).

All installations of the Weblate command‑line client (wlc) prior to version 2.0.1 are affected when an unscoped API token is supplied without an accompanying explicit URL (WLC_URL or --url). The issue is triggered by untrusted directories that contain inherited configuration files, and it also applies to pull‑request build environments where the client runs automatically.

The baseline CVSS score of 2.3 indicates a low severity assessment, and the EPSS score is not provided. The vulnerability is not listed in CISA’s KEV catalog. The attack requires the attacker to cause wlc to execute within an environment that can access the project‑configured URL, such as a CI pipeline or a local pull‑request checkout. Although the probability of exploitation is not high, the potential for unauthorized API access warrants immediate remediation. The fix is available in version 2.0.1 and later, so upgrading is the most effective defense.