CVE-2026-86042

Impact An authenticated user who can import project backups can craft a backup containing a "weblate://" repository link to a component they cannot access. During restoration, Weblate did not enforce the component.edit permission check used by the normal UI and API. The imported component could...