Modelo de amenazas de Weblate

Project: Weblate

Last reviewed for Weblate 2026.8 at commit 491e79010b2.

Date: 2026-05-14.

Status: Accepted, 2026-05-14.

Vinculación a la versión: Este modelo se versiona con las versiones de Weblate. Un parte relativo a la versión N de Weblate se evalúa en función del modelo publicado para la versión N, y no en función de la última rama de desarrollo. (responsable)

Referencia cruzada de partes: Los partes que violan una propiedad que reclama Weblate en Propiedades de seguridad que proporciona Weblate son informados a través de SECURITY.md y Vulnerabilidad y tratamiento de incidente. Los partes que caen bajo Fuera del alcance o Propiedades de seguridad que no proporciona Weblate pueden cerrarse citando este documento a menos que este modelo los enruté a VALID-HARDENING. (documentado) (fuente: Vulnerabilidad y tratamiento de incidente)

Provenance legend: *(documented)* means the claim is stated in Weblate documentation; *(maintainer)* means it was stated by a maintainer during this threat-model process; *(inferred)* means it was reasoned from the current project shape and needs maintainer confirmation.

Provenance summary: 103 documented / 64 maintainer / 0 inferred claims.

Weblate is a Django-based web localization platform. It accepts work from browser users, API clients, project-scoped tokens, repository webhooks, VCS repositories, backup archives, background workers, and configured external services, then stores and synchronizes translation projects through a database, datastore, local filesystem repositories, and external code-hosting systems. (documented) (source: Documentación de Weblate, API REST de Weblate, Localización continua)

Scope and intended use

Component family	Superficie representativa	Efectos ajenos al proceso	Model status
Web UI and REST API	Vistas de navegador, formularios, puntos finales de sesión, API REST de Weblate	Base de datos, almacén de datos, correo-e, registros, archivos subidos	Dentro del ámbito de aplicación. (documentado) (origen: API REST de Weblate, Instrucciones de configuración)
Partes de traducción almacenados	Formularios del parte y GET /api/reports/ de puntos finales	Database snapshots and background tasks	Dentro del alcance como ámbitos autenticados, los datos del contribuidor con permisos marcados con relación al operador configurado. (documentado) (origen: Partes de progreso de la traducción, API REST de Weblate)
Autenticación, sesiones, y autorización	Iniciar sesión, 2FA, SSO, equipos, permisos, acceso a proyectos, vales de API	Database, identity providers, browser cookies	Dentro del ámbito. (documentado) (fuente: Autenticación, Control de acceso)
Project-scoped API tokens	Tokens created in project API access	Same application effects as the token permissions allow	In scope as authenticated actors with delegated project scope. (documented) (source: API REST de Weblate, Control de acceso)
Webhooks	Actuadores de notificación, proyecto Activar actuadores, URL de gancho a App	Background task scheduling and VCS repository updates	En ámbito como uno público, interfaz de despliegue-reforzado. (documentado) (origen: Actuadores de notificación y Activar actuadores, URL de gancho a App)
Integración en VCS	Repository URLs, branches, pushes, pulls, merge requests, local clones	Filesystem, child VCS commands, SSH/HTTPS network connections	In scope when reachable through Weblate configuration or project content. (documented) (source: Localización continua, Integraciones de código‐hospedado)
Background tasks	Celery queues for repository updates, notifications, translation memory, translation, and backups	Database, datastore, filesystem, outbound network	In scope as Weblate-controlled execution of user or operator actions. (documented) (source: Instrucciones de configuración)
Project backup import/export	Copias de respaldo a nivel del proyecto, proyecto API REST de Weblate de respaldo en punto final, import_projectbackup	Uploaded ZIP archives, generated backup archives, filesystem restore, repository state	Dentro del ámbito. (documentado) (fuente: Respaldar y trasladar Weblate, :API REST de Weblate, Órdenes de gestión)
Service backup	BorgBackup configuration and backup	Local or remote backup storage over filesystem or SSH	In scope for Weblate’s handling of configured backup jobs; Borg itself is out of scope. (documented) (source: Respaldar y trasladar Weblate, Órdenes de gestión)
Machine translation and outbound integrations	Traducción por máquina, avatares, partes de estado, telemetría, partes de errores, hospedajes VCS, conexiones App Github, complemento de CDN, complemento Fedora Messaging	Outbound HTTP(S), AMQP(S), provider APIs, logs	Entra dentro del ámbito de aplicación de la aplicación por parte de Weblate de las restricciones al acceso y de red configuradas. El comportamiento del Proveedor queda fuera de este ámbito. (documentado) (origen: Configuración, Integraciones de código‐hospedado, Complementos)
Complementos	Built-in add-ons and administrator-configured add-on execution	Varies by add-on; can mutate repositories or contact services	Built-in add-ons are in scope when enabled. Third-party add-ons are out of scope except for Weblate’s permission and installation gates. (maintainer)
Órdenes de gestión	weblate commands run by an operator	Database, filesystem, VCS, backup storage	In scope when processing untrusted Weblate data; the local operator shell is trusted. (maintainer)
Tests, generated docs, screenshots, development fixtures	docs/_build/, docs/screenshots/, tests, local fixtures	Development-only files and generated artifacts	Out of scope for product security claims. (maintainer)

The intended deployment is a server-side Weblate installation behind a web server or reverse proxy, with a WSGI or ASGI application server, PostgreSQL database, datastore, Celery workers, a writable data directory, and optional outbound VCS, backup, identity-provider, and machine-translation integrations. (documented) (source: Instrucciones de configuración)

The WSGI and ASGI deployment modes expose the same Django HTTP request surface and rely on the same reverse-proxy controls. ASGI deployment does not add a WebSocket interface. (documented) (source: Sample configuration to start Granian with ASGI)

The relevant actors are split by trust level: unauthenticated clients, authenticated users, reviewers, project managers, administrators, project-scoped API tokens, webhook senders, external VCS providers, configured external services, and local operators. (documented) (source: Control de acceso, API REST de Weblate)

Weblate is not intended to be embedded as an in-process security library, used as a sandbox for untrusted code, or exposed without the deployment controls documented for production use. (maintainer)

Out of scope

The following are explicit non-goals for this model:

• A compromised operating system account, container runtime, database server, datastore, reverse proxy, or administrator shell. Weblate runs inside those boundaries and does not claim to protect itself from an already-compromised host. (maintainer)

• A malicious Weblate site administrator or local operator with unrestricted server access. Such an actor can change settings, credentials, data, or code. (maintainer)

• Vulnerabilidades en dependencias de terceros como proyectos independientes. Django general, Django REST framework, Python Social Auth, BorgBackup, VCS, base de datos y vulnerabilidades de proveedores se reportan en la parte superior a menos que la incidencia esté en el uso de Weblate. (documented) (origen: Vulnerabilidad y tratamiento de incidente)

• Build and release hygiene, including action pinning, artifact signing, dependency freshness, and repository branch protection. These affect project operations but are not threat-model claims about Weblate runtime behavior. (maintainer)

• General security of external VCS providers, identity providers, mail servers, machine-translation services, avatar services, CDN storage, or backup storage. Weblate models only its configured interactions with them. (maintainer)

• User organizations” translation-supply-chain choices outside Weblate. Outsourced or crowdsourced translator risks are described separately in Modelo de Hilo de Regionalización. (documented) (source: Modelo de Hilo de Regionalización)

• Third-party add-on code, local customization code, development fixtures, generated documentation output, test-only code, and demo or example data. (maintainer)

Trust boundaries and data flow

Weblate’s primary trust boundary is the network-facing application surface: browser views, API endpoints, webhook endpoints, and upload endpoints accept data from less-trusted actors and translate it into database rows, local repository state, background tasks, outbound requests, and rendered UI. (maintainer)

Acotación	Trust transition
Client browser/API client to Weblate	Untrusted or authenticated requests become permission-checked application actions. (documented) (source: API REST de Weblate, Control de acceso)
Webhook sender to Weblate	Las notificaciones públicas de la forja pueden programar la sincronización del repositorio cuando los ganchos están habilitados. (documentado) (fuente: Actuadores de notificación, Activar actuadores, URL de gancho a App)
Weblate para base de datos/almacén de datos	Permission-checked application state becomes persistent data and queued work. (documented) (source: Instrucciones de configuración)
Weblate to local VCS repositories	Project configuration and repository content drive filesystem and VCS operations. (documented) (source: Localización continua)
Weblate to external services	Configured URLs, credentials, and provider settings drive outbound network connections. (documented) (source: Integraciones de código‐hospedado, Configuración)
Project backup archives and Weblate filesystem	Los miembros y metadatos cargados desde el ZIP se convierten en el estado restaurado del proyecto. (documentado) (fuente: Respaldar y trasladar Weblate, API REST de Weblate, Copias de respaldo a nivel del proyecto)

Reachability preconditions:

• A web UI or API finding is in model only when reachable by an unauthenticated client, authenticated user, or project-scoped token through documented routes, forms, or API endpoints. (maintainer)

• An authorization finding is in model only when it crosses a documented permission, team, project, component, language, glossary, token, or site-wide boundary. (documented) (source: Control de acceso)

• A webhook finding is in model only when a request can reach an enabled hook endpoint and affect repository update scheduling, task volume, or information returned to the caller. (documented) (source: Actuadores de notificación, Activar actuadores)

• A VCS finding is in model only when attacker-controlled or less-trusted repository data, branch names, URLs, file names, commit metadata, or project configuration can influence Weblate’s VCS operations. (maintainer)

• A backup import finding is in model only when reachable from a project backup uploaded through Weblate or supplied to import_projectbackup. (documented) (source: Copias de respaldo a nivel del proyecto, import_projectbackup)

• Un hallazgo de exportación de respaldo solo está en el modelo cuando se puede acceder desde una creación de respaldo del proyecto documentado o rutas de descargas, incluyendo el REST API para usuarios o vales de proyecto de ámbito con permisos de edición del proyecto. (documentado) (origen: API REST de Weblate, Copias de respaldo a nivel del proyecto, Control de acceso)

• A background-task finding is in model only when the task can be queued from an in-scope Weblate surface or scheduled Weblate maintenance path. (documented) (source: Instrucciones de configuración)

• Se considera que un hallazgo de parte de almacenado se ajusta al modelo cuando un usuario autenticado puede generar, enumerar o representar datos de colaboradores fuera del ámbito del creador o del ámbito actual de reports.view. (documentado) (origen: Partes de progreso de la traducción, API REST de Weblate)

• A management-command finding is in model only when untrusted Weblate data is processed by the command; arbitrary local shell access is not an attacker capability. (maintainer)

Environment assumptions

Weblate assumes a supported Python and Django runtime, a correctly configured database, a datastore, a writable data directory, and running workers for features that require background processing. (documented) (source: Instrucciones de configuración)

Production deployments are expected to configure the external web server or reverse proxy consistently with Weblate’s HTTPS, host header, body-size, and proxy-header settings. (documented) (source: Instrucciones de configuración, ENABLE_HTTPS, ALLOWED_HOSTS)

The database, datastore, and internal service ports are assumed not to be directly exposed to untrusted networks. (maintainer)

Filesystem permissions are assumed to prevent unrelated local users from modifying Weblate’s data directory, configuration, VCS repositories, generated SSH wrappers, backups, and secret material. (documented) (source: Respaldar y trasladar Weblate, Instrucciones de configuración)

Celery workers are trusted components of the same Weblate instance. A malicious or compromised worker is equivalent to a compromised application process. (maintainer)

VCS command execution, SSH, and HTTPS clients are assumed to execute as the Weblate service user with the credentials configured for the relevant project or integration, including database-stored GitHub App credentials used for installation tokens and webhook signature verification. (documented) (source: Integraciones de código‐hospedado, SSH_EXTRA_ARGS)

Qué hace Weblate a su host:

• Abre conexiones de red salientes para VCS configurado, proveedor de identidad, avatar, máquina de traducción, copia de respaldo, parte de estado, telemetría, parte de errores y funciones de complemento tales como gancho web saliente y entrega de Fedora Messaging AMQP. (documentado) (origen: Configuración, Integraciones de código‐hospedado, Respaldar y trasladar Weblate)

• It runs VCS and backup-related helper commands as part of repository and backup workflows. (documented) (source: Localización continua, Respaldar y trasladar Weblate)

• It writes to the configured data directory, repository storage, media/fonts, backup dumps, logs, and cache locations. (documented) (source: Configuración, Respaldar y trasladar Weblate)

• It sends e-mail and notifications when configured to do so. (documented) (source: Configuración)

• It does not claim to be free of process-wide side effects such as logging, cache writes, subprocess execution, or outbound network access. (maintainer)

Build-time and configuration variants

Perilla	Por defecto o postura documentada	Effect on the model	Maintainer stance
ENABLE_HOOKS y Activar actuadores	Anonymous remote hooks are configurable and must also be enabled for a project. (documented)	Expone webhook punto final como un interfaz de planificación pública. Resistencia de abuso depende de controles de despliegue. (documentado) (origen: Actuadores de notificación y Activar actuadores)	Production deployments exposing hooks use reverse-proxy rate limits, body-size limits, monitoring, and minimal public exposure. (maintainer)
ENABLE_HTTPS, proxy SSL headers, and HSTS settings	HTTPS affects secure cookies, redirects, HSTS, WebAuthn, and generated URLs. (documented) (source: ENABLE_HTTPS)	Disabling or misconfiguring HTTPS removes transport and cookie protections that Weblate relies on for browser security. (documented) (source: ENABLE_HTTPS)	The documented production posture is HTTPS with correct proxy headers. (documented)
ALLOWED_HOSTS	Configura los nombres de host HTTP aceptados. (documentado) (origen: ALLOWED_HOSTS)	Broad host acceptance can weaken host-header based protections and URL generation assumptions. (maintainer)	Production deployments restrict this to instance hostnames. (maintainer)
WEBLATE_API_RATELIMIT_ANON, WEBLATE_API_RATELIMIT_USER, RATELIMIT_ATTEMPTS, y RATELIMIT_GITHUB_SETUP_ATTEMPTS	Rate limits are configurable. (documented) (source: API REST de Weblate, Configuración)	Availability claims assume rate limits appropriate to deployment size and exposure. (maintainer)	Deshabilitando límites de tasa cambia triage DoS de Weblate bug a postura de despliegue a no ser que una petición sola viola una propiedad alegada. (maintainer)
CSP_SCRIPT_SRC, CSP_IMG_SRC, CSP_CONNECT_SRC, CSP_STYLE_SRC, CSP_FONT_SRC, CSP_FORM_SRC	Las fuentes de la Directiva de Seguridad de Contenido son configurables. (documentado) (origen: Configuración)	Ampliar las fuentes puede reducir la contención del lado del navegador para XSS o contenido de terceros. (mantenedor)	Las implementaciones que agregan fuentes de terceros aceptan esa confianza ampliada del navegador. (mantenedor)
PROJECT_BACKUP_UPLOAD_MAX_SIZE, PROJECT_BACKUP_IMPORT_MAX_MEMBERS, PROJECT_BACKUP_IMPORT_MAX_TOTAL_UNCOMPRESSED_SIZE, PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_SIZE, PROJECT_BACKUP_IMPORT_MIN_RATIO_SIZE, PROJECT_BACKUP_IMPORT_MAX_COMPRESSED_ENTRY_RATIO	Vínculos por defecto subida del respaldo del proyecto e importación, número de miembros y ratios de compresión sospechosos. Por defecto (documentado) (origen: Configuración)	Aumentar o deshabilitar estos límites incrementa la exposición de recursos durante la restauración. (documentado) (fuente: Configuración)	Los valores predeterminados documentados anteriormente forman parte de las garantías de recursos de la importación de copias de respaldo. (documentado)
Restricciones de destino privado y listas de permitidos para URL salientes	User-configurable outbound URL surfaces documented with private-target restriction settings, including Fedora Messaging AMQP broker URLs, reject internal or non-public targets by default. (documented) (source: ASSET_RESTRICT_PRIVATE, PROJECT_WEB_RESTRICT_PRIVATE, WEBHOOK_RESTRICT_PRIVATE, VCS_RESTRICT_PRIVATE) Protected Git HTTPS and SSH operations are bound to addresses approved by runtime validation. Protected SSH operations validate the effective HostName and Port. Trusted administrator SSH configuration can alter routing, and SSH_EXTRA_ARGS can override connection binding. Git LFS object transfers are disabled and outside the supported VCS integration surface. VCS clients without connection binding require an explicit trusted-host exemption. (maintainer)	La configuración de la lista de concedidos y la configuración de privilegios pueden ampliar intencionalmente la accesibilidad. (documentado) (origen: ASSET_PRIVATE_ALLOWLIST, PROJECT_WEB_RESTRICT_ALLOWLIST, WEBHOOK_PRIVATE_ALLOWLIST, VCS_ALLOW_HOSTS)	El rechazo predeterminado de destino privado es una propiedad de seguridad a nivel de aplicación para las superficies de URL configurables por el usuario documentadas. (mantenedor)
SSH_EXTRA_ARGS	Concede opciones SSH personales. (documentado) (origen: SSH_EXTRA_ARGS)	Weakening SSH algorithms or host verification changes VCS transport assumptions. Routing options can override protected repository address pinning. (maintainer)	Los operadores son responsables del impacto en la seguridad de las opciones SSH personalizadas. (mantenedor)
Complementos de terceros y personalización local	Los administradores pueden ampliar el comportamiento. (documentado) (fuente: Complementos)	El código personalizado puede agregar nuevos límites de confianza y propiedades de seguridad fuera de este modelo. (mantenedor)	El código de terceros se modela por separado. (mantenedor)

Input assumptions

Superficie	Entrada	¿Controlable por el atacante?	El invocante u operador deben hacer cumplir
Formularios del navegador y API REST	Cuerpos de solicitud, cadenas de consulta, archivos cargados, encabezados, cookies	Sí, dentro del estado de autenticación del actor. (documentado) (fuente: API REST de Weblate)	HTTPS, configuración correcta de host/proxy, límites de velocidad y asignación de permisos. (documentado) (fuente: Instrucciones de configuración, Control de acceso)
Authentication endpoints	Contraseñas, datos de autenticación web, devoluciones de llamada de SSO, tokens de restablecimiento	Sí. (documentado) (fuente: Autenticación)	Configuración correcta del proveedor de identidad y HTTPS. (documentado) (fuente: Autenticación, ENABLE_HTTPS)
Project-scoped tokens	API requests authenticated by token	Sí, por quien posea el vale. (documentado) (fuente: API REST de Weblate)	Almacenamiento, rotación y pertenencia al equipo con privilegios mínimos para el vale. (mantenedor)
Translation content	Source strings, translations, comments, suggestions, glossary entries; suggestion API requests including rejection_reason text, is_spam flag, and approve flag	Sí, de usuarios con los permisos pertinentes o repositorios importados. (documentado) (fuente: Traducir con Weblate, Control de acceso)	Revise los flujos de trabajo para garantizar la integridad; aprobando una sugerencia por medio del API adicionalmente requiere el comprobante de permiso unit.review para ser satisfecho. (documentado) (fuente: Flujos de trabajo de traducción, API REST de Weblate)
Puntos finales de Gancho Web	Encabezados, tipo de evento, cuerpo, repositorio y metadatos de rama	Sí, donde el punto final es alcanzable. (documentado) (fuente: Actuadores de notificación)	Hook enablement only where needed, request limits, and monitoring. (maintainer)
GitHub App connection callbacks	GitHub OAuth code, signed Weblate state, installation ID, account metadata	Yes, from authenticated Weblate users and GitHub redirect query strings. (documented) (source: Registrando el GitHub App desde Weblate)	Weblate requires workspace management rights and verifies that the GitHub user owns the personal installation or can administer the organization installation before saving it. (documented) (source: Registrando el GitHub App desde Weblate)
Repository configuration	Repository URLs, branches, push URLs, credentials, Gerrit review push options, add-on settings	Trusted to users with corresponding management permissions. (documented) (source: Control de acceso, Localización continua)	Assign VCS and project management permissions only to trusted users. (documented) (source: Control de acceso)
Contenido del repositorio externo	Translation files, paths, branch names, commit metadata	Sí, si el repositorio en desarrollo está controlado por otro actor. (maintainer)	Trust the configured upstream repository or review imported changes. (maintainer)
Project backup import	ZIP archive members, metadata, translation files, repository state	Sí, para quienquiera puede subir o proporcionar la copia de respaldo. (documentado) (origen: Copias de respaldo a nivel del proyecto)	Keep import limits at values appropriate for the instance. (documented) (source: Configuración)
Project backup export	Backup creation requests and requested backup file names	Sí, para usuarios o vales de ámbito de proyecto con permiso de edición del proyecto. (documentado) (fuente: API REST de Weblate, Copias de respaldo a nivel del proyecto, Control de acceso)	Grant project edit permission only to trusted project administrators. (documented) (source: Control de acceso)
Configuración de máquinas de traducción y servicio externo	Provider URLs, credentials, model or service settings	Trusted to administrators or users granted configuration permissions. (documented) (source: Sugerencias automáticas, Control de acceso)	Treat configured providers as recipients of the data sent to them; the submitted content varies by provider and enabled feature. (maintainer)
Órdenes de gestión	Command-line arguments and files supplied by the local operator	Trusted local input unless processing Weblate data or project backups. (maintainer)	Restrict shell access to trusted operators. (maintainer)

Tamaño y tipo de asunciones:

• Weblate relies on application and reverse-proxy upload limits for large HTTP requests. (documented) (source: PROJECT_BACKUP_UPLOAD_MAX_SIZE)

• Project backup imports are bounded by member count, aggregate uncompressed size, compressed entry size, minimum ratio size, and compression ratio settings. (documented) (source: Configuración)

• Project backup metadata, object references, repository paths, outbound URLs, regular expressions, and screenshot content are validated before restore writes project state. Failed restores remove repository and media objects created by that attempt. (documented) (source: Copias de respaldo a nivel del proyecto)

• API and selected web actions are expected to be protected by configured rate limits. (documented) (source: API REST de Weblate, Configuración)

• Repository size, number of projects, number of components, and worker capacity are deployment-sizing concerns unless a single in-scope input bypasses documented limits or permissions. (maintainer)

Adversary model

Actor	In-scope capabilities	Out-of-scope capabilities
Cliente de Internet no autenticado	Send HTTP(S) requests to public pages, registration, login, API, and reachable webhook endpoints. (documented) (source: API REST de Weblate)	Read server memory, bypass reverse proxy controls, or access internal services directly. (maintainer)
Authenticated user	Perform actions allowed by assigned teams, permissions, and workflow. (documented) (source: Control de acceso)	Actúa permisos asignados externos sin explorar un Weblate defectuoso. (documentado) (origen: Control de acceso)
Reviewer or project manager	Ejercicio delegó proyecto, componente, idioma, revisión, VCS, memoria de traducción, capturas, o permisos del gestor de acceso. (documentado) (origen: Control de acceso)	Become a site administrator unless granted that role or exploiting a Weblate flaw. (maintainer)
Project-scoped API token holder	Use API permissions assigned to the token’s team memberships, including project backup creation and download where project edit permission is granted. (documented) (source: API REST de Weblate, Control de acceso, Copias de respaldo a nivel del proyecto)	Access projects, components, or site-wide functions outside its scope. (documented) (source: Control de acceso)
Webhook sender	Send forged, replayed, malformed, or high-volume webhook requests to enabled hook endpoints. (documented) (source: Actuadores de notificación)	Obtain forge-authenticated identity where Weblate does not verify it. (maintainer)
External VCS or service provider	Return repository data, API responses, redirects, or errors according to the configured integration. (documented) (source: Integraciones de código‐hospedado)	Compromise the Weblate host except through data or protocol behavior Weblate processes. (maintainer)
Translator or localization contributor	Submit translation content that downstream applications might consume. (documented) (source: Modelo de Hilo de Regionalización)	Control downstream application escaping, rendering, or review policy outside Weblate. (documented) (source: Modelo de Hilo de Regionalización)
Local operator	Run management commands, change configuration, and access backups. (documented) (source: Órdenes de gestión, Respaldar y trasladar Weblate)	Local malicious operators are trusted for this model. (maintainer)

The modeled attacker tries to bypass authorization, modify translation or repository data without permission, disclose private project or user data, forge or abuse repository synchronization, trigger unsafe outbound requests, execute commands through Weblate-controlled workflows, or exhaust bounded application resources. (maintainer)

Security properties Weblate provides

Property	Conditions	Violation symptom	Severity tier
Autorización de web separa el sitio, proyecto, componente, idioma, glosario, VCS, memoria de traducción, capturas, revisión, y permisos de gestión de acceso. (documentado) (origen: Control de acceso, Autenticación)	Permission assignments match the intended trust relationship. Team-level enforced 2FA is satisfied by human users before team-derived permissions apply.	User or token can read or mutate data outside assigned scope.	Security-critical when private data or privileged mutation is exposed.
Project-scoped API tokens are limited by assigned project/team permissions. (documented) (source: API REST de Weblate, Control de acceso)	Token is created and stored by a trusted actor.	Token can act outside project or team scope.	Seguridad‐crítica.
Authentication and session controls protect browser sessions when HTTPS and proxy settings are correct. (documented) (source: Autenticación, ENABLE_HTTPS)	Production HTTPS and secure-cookie settings are enabled.	Session fixation, credential bypass, or cross-user session confusion.	Seguridad‐crítica.
User-supplied content rendered by Weblate is expected not to execute script in other users” browsers. (maintainer)	Content is displayed through Weblate UI templates and standard escaping.	Stored or reflected XSS in the Weblate origin.	Seguridad‐crítica.
Repository, branch, path, and VCS inputs processed by Weblate must not become shell command execution. (maintainer)	VCS operations are invoked through Weblate-supported repository workflows and configured credentials.	Inyección de comando o ejecución de código arbitrario debido al usuario de Weblate.	Seguridad‐crítica.
Private project data, user data, credentials, tokens, SSH keys, and 2FA secrets are not disclosed to actors lacking permission. (documented) (source: Control de acceso, Cumplimiento de las normas de privacidad)	Host, database, and storage permissions are intact.	Cross-project data leak, credential exposure, or unauthorized export.	Seguridad‐crítica.
Backup import rejects archives exceeding documented upload, member, aggregate size, and suspicious compression thresholds. (documented) (source: Configuración, Copias de respaldo a nivel del proyecto)	Defaults or stricter limits remain configured.	Oversized or highly amplified archive is accepted past configured thresholds.	Security-critical for single-request DoS; otherwise availability bug.
Documented user-configurable outbound URL surfaces reject internal or non-public targets by default. (documented) (source: ASSET_RESTRICT_PRIVATE, PROJECT_WEB_RESTRICT_PRIVATE, WEBHOOK_RESTRICT_PRIVATE, VCS_RESTRICT_PRIVATE)	Default private-target checks are enabled and no trusted allowlist exemption applies. VCS restrictions remain enabled, Git HTTPS and SSH address binding is not bypassed, and VCS backends without binding use only explicitly trusted hosts.	A user-configurable screenshot URL, remote HTML URL, project website or repository browser URL, outbound webhook URL, Fedora Messaging AMQP broker URL, or VCS URL reaches an internal or non-public target despite default controls.	Security-critical when it exposes internal services or metadata.
Weblate records security-relevant account, permission, and project or component setting changes in audit logs or history. (documented) (source: Cumplimiento de las normas de privacidad, Weblate 2026.8)	Logging is configured and storage is available.	Missing audit trail for an action Weblate claims to log.	Security-critical when it blocks investigation of privileged changes; correctness-only for minor event gaps.
Rate-limited API and web actions enforce configured rate limits. (documented) (source: API REST de Weblate, Configuración)	Rate limiting is enabled and backed by a working datastore.	Requests exceeding configured thresholds continue to be processed.	Availability/security hardening depending on endpoint sensitivity.
Weblate does not intentionally expose database, datastore, backup storage, or raw internal storage directly through the public web interface; exported VCS repositories are intentionally exposed by Exportador de Git when that optional module is enabled; authorized project backup downloads are intentionally exposed through documented project backup routes. (documented) (source: API REST de Weblate, Copias de respaldo a nivel del proyecto) (maintainer)	Deployment does not serve internal storage paths as static files except for documented export features.	Public request retrieves raw internal storage, configuration, or non-exported repository data.	Seguridad‐crítica.

Resource thresholds in this model are the documented configuration defaults where they exist, especially backup import limits and rate limits. For repository size, project count, component count, and translation volume, Weblate does not claim a fixed universal resource ceiling independent of deployment capacity. (maintainer)

Security properties Weblate does not provide

Weblate does not authenticate every webhook delivery cryptographically for all supported forge integrations. Hook endpoints are compatibility-oriented and deployment-hardened rather than uniformly forge-authenticated. Reports that show only unauthenticated triggering within modeled effects are VALID-HARDENING rather than BY-DESIGN. (maintainer)

Weblate does not make an unauthenticated webhook equivalent to a trusted forge identity. Hook processing can trigger update workflows, but attribution and authenticity are weaker than for an authenticated user or token. (maintainer)

Weblate is not a sandbox for malicious administrators, malicious local operators, third-party add-ons, custom deployment code, VCS clients, or backup tools. (maintainer)

Weblate does not guarantee that translation content is safe when copied into a downstream product without that product’s own escaping, validation, or review. Translation checks and review workflows help manage localization quality and risk; they are not a complete downstream application security boundary. (documented) (source: Modelo de Hilo de Regionalización, Comprobaciones y correcciones)

False friends:

• Weblate permissions are application authorization, not a host sandbox. A user granted VCS or project management permissions can intentionally configure integrations within that role’s power. (maintainer)

• Webhook project matching and event parsing are not proof that the sender is the legitimate forge when the integration does not authenticate the delivery. (maintainer)

• Translation checks detect common quality and format problems; they are not a guarantee that translated strings are safe for every downstream renderer. (documented) (source: Comprobaciones y correcciones, Modelo de Hilo de Regionalización)

• BorgBackup encryption protects backup archives according to Borg’s design; Weblate does not add a separate cryptographic guarantee for Borg internals. (documented) (source: Respaldar y trasladar Weblate)

• Rate limits reduce abuse of configured endpoints; they are not a guarantee of availability under volumetric network attacks. (maintainer)

Well-known attack classes left partly or wholly to deployment or downstream systems:

• Phishing and credential reuse are mitigated by authentication policy and 2FA, but Weblate cannot prevent users from disclosing credentials outside the service. (maintainer)

• Malicious translations can become XSS, format-string, command, or policy problems in downstream applications that render them unsafely. (documented) (source: Modelo de Hilo de Regionalización)

• User-configurable outbound URL surfaces with documented private-target restrictions reject internal or non-public targets by default; privileged allowlists, proxies, and administrator-controlled configuration can intentionally expand reachability. (maintainer)

• Large repository histories, project scale, and background task volume require deployment sizing and operational limits beyond Weblate’s single-input validation. (maintainer)

Downstream responsibilities

Operators must deploy Weblate behind production-grade HTTPS with correct proxy headers, hostnames, request-size limits, and secure-cookie behavior. (documented) (source: Instrucciones de configuración, ENABLE_HTTPS, ALLOWED_HOSTS)

Operators must assign teams, roles, project-scoped tokens, VCS credentials, and project management permissions according to least privilege for their organization. (documented) (source: Control de acceso, API REST de Weblate)

Operators exposing Actuadores de notificación must enable them only where needed and provide deployment controls such as reverse-proxy rate limits, body-size limits, monitoring, and optional source restrictions. (maintainer)

Operators must treat private-target allowlists, proxies, and privileged outbound integration settings as intentional expansion of Weblate’s default network reachability limits. (maintainer)

Operators must keep backup import limits, API rate limits, and web rate limits at values that match instance capacity and exposure. (documented) (source: Configuración)

Operators must protect the Weblate data directory, configuration, backup credentials, generated keys, database, datastore, and local shell access as trusted infrastructure. (documented) (source: Respaldar y trasladar Weblate, Instrucciones de configuración)

Downstream product teams must treat translated strings as untrusted content in their own applications unless they have separately reviewed, escaped, and validated them for the target renderer. (documented) (source: Modelo de Hilo de Regionalización)

Known misuse patterns

• Exposing webhook endpoints broadly, enabling project hooks, and relying on webhook payloads as authenticated forge identity. This is unsafe because some supported hooks are compatibility-oriented. Use deployment controls and prefer authenticated integrations where available. (maintainer)

• Granting project management, VCS, or access-management permissions to users who are trusted only as translators. This is unsafe because those permissions can affect repositories, credentials, or other users. Assign narrower roles. (documented) (source: Control de acceso)

• Sending sensitive source strings or private customer content to machine translation providers without treating the provider as a data recipient. This is unsafe because Weblate must transmit content to the configured service, and the submitted content varies by provider and enabled feature. Configure providers according to the data policy for the project. (maintainer)

• Importing project backups from untrusted sources as an administrative convenience. This is unsafe because backups carry project metadata, translation content, and repository state. Keep import limits enabled and import only backups appropriate for the target instance. (documented) (source: Respaldar y trasladar Weblate)

• Treating Weblate translation checks as proof that downstream applications cannot be attacked through translated strings. This is unsafe because the downstream renderer defines the final execution context. Review and escape translations in the consuming application. (documented) (source: Modelo de Hilo de Regionalización)

Known non-findings

• A report that a reachable webhook can be called without forge authentication and only triggers modeled update scheduling is not VALID by itself. It is routed to VALID-HARDENING unless it bypasses documented limits, leaks data, or causes effects beyond modeled scheduling. (maintainer)

• A report that a project manager can change repository settings, VCS credentials, or project configuration is not a vulnerability when the actor has the documented permission for that action. (documented) (source: Control de acceso)

• A report that a project manager can configure Gerrit review push options is not a vulnerability by itself. Gerrit interprets these options as the configured Weblate Gerrit account and enforces Gerrit-side permissions. (documented) (source: Rama a la que enviar)

• A report against third-party add-on behavior is not a Weblate core vulnerability unless the report shows Weblate’s permission or installation boundaries are bypassed. (maintainer)

• A report that a malicious local operator can read configuration, run management commands, or alter files is out of model because local operators are trusted infrastructure. (maintainer)

• A report that a downstream application renders a dangerous translation is not a Weblate vulnerability unless Weblate itself violates a claimed property while storing, checking, reviewing, or displaying that translation. (documented) (source: Modelo de Hilo de Regionalización)

Conditions that change this model

Revise this model when Weblate adds a new public endpoint family, a new authentication or token mode, a new default deployment mode, a new backup or import format, a new VCS execution path, a new outbound integration class, a new add-on execution capability, or a change to defaults for hooks, HTTPS, rate limits, CSP, private-network access, or backup import limits. (maintainer)

Revise this model when an unsupported component becomes supported product surface, when a documented security property is removed or narrowed, or when maintainers accept a vulnerability report that cannot be routed to a triage disposition below. (maintainer)

Triage dispositions

Disposition	Meaning	Licensed by
VALID	Violates a property Weblate claims, through an in-scope actor and input.	Security properties Weblate provides, Input assumptions, Adversary model
VALID-HARDENING	No claimed property is violated, but Weblate chooses to reduce a known misuse risk, such as compatibility webhook triggering that stays within modeled effects.	Known misuse patterns, Security properties Weblate does not provide
OUT-OF-MODEL: trusted-input	Requires attacker control of input this model marks trusted.	Asunciones de entrada
OUT-OF-MODEL: adversary-not-in-scope	Requires a capability this model excludes.	Adversary model
OUT-OF-MODEL: unsupported-component	Lands in third-party add-ons, generated docs, tests, local customization, or another component marked out of scope.	Out of scope
OUT-OF-MODEL: non-default-build	Manifests only after deployment choices that knowingly remove a claimed property.	Variantes de tiempo de compilación y configuración
BY-DESIGN: property-disclaimed	Concerns a property Weblate explicitly does not provide.	Security properties Weblate does not provide
KNOWN-NON-FINDING	Matches a documented recurring false positive.	Known non-findings
MODEL-GAP	Cannot be cleanly routed to any disposition above.	Conditions that change this model