Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

GHSA-m6hq-f4w9-qrjj | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceGHSA-m6hq-f4w9-qrjj

GHSA-m6hq-f4w9-qrjj

LOW1.0

Weblate has improper validation upon invitation acceptance

Published Dec 15, 2025

Modified 10 months ago

Fix available

Details

Impact

It was possible to accept an invitation opened by a different Weblate user.

Patches

https://github.com/WeblateOrg/weblate/pull/16913

Workarounds

Users should avoid leaving Weblate sessions with an unattended opened invitation.

References

Thanks to Nahid0x for responsibly disclosing this vulnerability to Weblate.

Affected Packages

Weblate

PyPI

Fixed in:

5.15

References

PACKAGE

https://github.com/WeblateOrg/weblate

WEB

https://github.com/WeblateOrg/weblate/commit/02e904675f0608a6bbfbf9466eeccd9d022591e9

WEB

https://github.com/WeblateOrg/weblate/pull/16913

WEB

https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15

WEB

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-m6hq-f4w9-qrjj

ADVISORY

https://github.com/advisories/GHSA-m6hq-f4w9-qrjj

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2025-64725

Aliases

CVE-2025-64725

CVSS Analysis

CVSS v4.0

1.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

HighAC:H

Attack Requirements

PresentAT:P

Privileges Required

LowPR:L

User Interaction

PassiveUI:P

Vulnerable System

Vuln. Confidentiality

LowVC:L

Vuln. Integrity

LowVI:L

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

1.0/CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVE-2025-64725

Ecosystems

PyPI

Timeline

PublishedDec 15, 2025

ModifiedDec 17, 2025