VDB
CVE-2025-64326
CVE-2025-64326
PUBLISHED
CVSS 2.6 LOW
Weblate leaks the IP of project member inviting user to be reviewer in Audit log
Reported by github_m · Published November 6, 2025
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.
Risk scores
CVSS 3.1
2.6
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| WeblateOrg | weblate | < 5.14.1 |
| WeblateOrg | weblate | 0 |
| PyPI | Weblate | 0 |
Timeline
- Nov 5, 2025 CVE Published
- Nov 6, 2025 CVE Updated
- Nov 7, 2025 EPSS Score (30 in total, the first dated here)
- Mar 10, 2026 Security Advisory
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-64326
vulnetix vdb fixes CVE-2025-64326Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-64326/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gr35-vpx2-qxhc x_refsource_CONFIRM
- https://github.com/WeblateOrg/weblate/pull/16781 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2025-64326 advisory
- https://github.com/advisories/GHSA-gr35-vpx2-qxhc advisory
- https://github.com/WeblateOrg/weblate/commit/b847e9756a0a6f7659ef20fa9f34846ca862c574 patch
- https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2025-230.yaml advisory