CVE-2025-64725 is an improper validation flaw in Weblate, the web based localization tool. Before version 5.15, a user could accept an invitation that a different user had opened. NVD scores it 9.8 critical, while the project advisory rates it low. Upgrade to 5.15 or later and judge the risk yourself.
What's affected
Weblate versions before 5.15 are affected, and 5.15 contains the patch. Both the record and the project advisory say the same thing about versions. The GitHub advisory lists the PyPI package Weblate with a vulnerable range below 5.15.
Here is the source conflict worth knowing about. The record carries a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which is Critical. The GitHub advisory for the same flaw uses the severity label Low. Both are on the page. The description is short: it was possible to accept an invitation opened by a different Weblate user. The advisory's own workaround suggests the realistic scenario is a shared or unattended session with an invitation page left open.
I cannot tell you which number matches your risk. A scoring system that sees a network attack with no privileges will give a very high number. A maintainer who knows that the flaw needs another person's open invitation will rate it lower. Read both, then decide based on how your Weblate instance handles invitations and who can log in.
How to check if you're exposed
Find the installed version. For a pip based install, run this in the same environment as Weblate:
pip show Weblate
For a container deployment, check the image tag you run and compare it with 5.15. If you track the latest tag, pull and inspect the running version in the admin interface.
Next, check how invitations are used. If your instance never sends invitations, the affected code path is less relevant to you, though you should still update. If you invite external translators or new project members often, treat the fix as more urgent.
What to do now
- Upgrade Weblate to 5.15 or later.
- Until you can upgrade, follow the advisory workaround. Do not leave a Weblate session open on an invitation page on a shared or unattended device.
- Ask people who were invited recently to confirm they are in the right account. Review membership of projects and teams for names you do not recognize.
- Check your upgrade process. If you pin Weblate in a requirements file, make sure the pin is updated, not only the running server.
- Note both severity ratings in your ticket so reviewers see why the priority was chosen.
Why it matters
The weakness is classified as CWE-286, incorrect user management. An invitation is a bearer of trust. Whoever accepts it gains membership, so the system must check that the person accepting is the person the invitation was meant for. If that check is missing, anyone who can reach the page with the right state can take the invitation.
Flaws like this are easy to underrate because they need a certain situation, and easy to overrate because automated scores assume the worst case. The honest position is to patch, because the fix is a normal upgrade, and to be open about the rating dispute. The record says nothing about exploitation in the wild and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the two sources disagree on severity?
The record's CVSS score assumes an attacker with network access and no prior privileges, which gives 9.8. The project advisory labels the same flaw Low, likely because it needs a specific situation. Both are published, so cite both.
Is there a workaround if I cannot upgrade today?
Yes. The advisory says to avoid leaving Weblate sessions unattended with an invitation open. That reduces risk but does not replace the upgrade to 5.15.
Sources
Last reviewed: 18 October 2026.
