CVE-2026-22251

Published: Jan 12, 2026Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.

Affected (1)

Products: Weblate: Wlc

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Weblate Wlc	Before 1.17.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (3)

https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797

Source: security-advisories@github.com

Patch

https://github.com/WeblateOrg/wlc/pull/1098

Source: security-advisories@github.com

Issue Tracking

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.