PYSEC-2026-2052
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/wlc/PYSEC-2026-2052.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2052
- Aliases
- Published
- 2026-07-07T16:03:18Z
- Modified
- 2026-07-07T17:46:16Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- Weblate wlc has insecure API key configuration
- Details
-
Impact
Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.
Patches
Workarounds
Remove unscoped
keyfrom wlc configuration. Only use URL-scoped keys in the[keys]sections.References
This issue was reported to us by wh1zee via HackerOne.
- References
-
- https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766
- https://nvd.nist.gov/vuln/detail/CVE-2026-22251
- https://github.com/WeblateOrg/wlc/pull/1098
- https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797
- https://github.com/WeblateOrg/wlc
- https://pypi.org/project/wlc
- https://github.com/advisories/GHSA-9rp8-h4g8-8766
Affected packages
PyPI / wlc
Package
- Name
- wlc
- View open source insights on deps.dev
- Purl
- pkg:pypi/wlc
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.17.0