← Database

CVE-2026-41519

MEDIUM CVSS: 4.2 Published: 2026-05-07 Modified: 2026-06-17

Description

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.

Affected Platforms

Weblate Weblate

Weakness Type

CWE-613

References