CVE-2026-41519

MediumCVSS 5.4/10Last modified Oct 26, 2026

Description

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
WeblateOrg	weblate	< 5.17.1

References

https://github.com/WeblateOrg/weblate/commit/649a2da81700542f95c0807b3c625fc3bb0eaf95Patch
https://github.com/WeblateOrg/weblate/pull/19057Issue Tracking, Patch
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1Release Notes
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6j8j-4qp3-36p2Patch, Vendor Advisory

Timeline

Published: May 7, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-41527.8GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2026-415204.4Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, th CVE-2026-415219.1xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update message CVE-2026-415227.1Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, CVE-2026-415237.5vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activati CVE-2026-415248.7Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is sto CVE-2026-415256.5KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbo CVE-2026-415267.8In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This CVE-2026-415276.9KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the me CVE-2026-41537.8GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2026-415304.6The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected CVE-2026-415396.1A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then