Weblate allows authenticated users to change a user's primary email address by sending a PUT or PATCH request to /api/users/{username}. The new email is not verified, so an attacker can set the address to one they control. Subsequently, a team invitation to that address can be accepted without access to the original owner's mailbox, effectively granting the attacker control of the account. This flaw is an authentication bypass (CWE‑302) coupled with improper input validation (CWE‑841). Because the account remains authenticated, the attacker simply exploits a privilege that exists for legitimate users.

Weblate, the web‑based localization platform provided by WeblateOrg, is affected in all releases prior to version 2026.8. The fix was introduced in 2026.8, so any deployment using an earlier release must update.

The CVSS score of 3.5 signals a low base severity; however the exploit requires a legitimate authenticated session. An attacker in possession of any user account can deliberately change the email to an address they own and then accept an invitation, bypassing normal invitation flow. The EPSS score is unspecified, and the vulnerability is not listed in the CISA KEV catalog, indicating no active exploitation has been reported. Nonetheless, if an attacker gains or compromises an account, they can subsequently hijack the account via the invitation mechanism. The risk therefore remains moderate for environments where many users share a single account or where invitation acceptance is automated.