Hi,

The following vulnerability was published for wlc.

CVE-2026-62364[0]:
| wlc is a Weblate command-line client using Weblate's REST API. Prior
| to 2.0.1, automatically discovered configuration from .weblate,
| .weblate.ini, or weblate.ini can select the API URL while an
| unscoped API token is supplied through WLC_KEY or --key without a
| matching WLC_URL or --url. When wlc runs in an untrusted repository,
| pull request checkout, or directory with untrusted ancestor
| configuration, it can send the token to an attacker-controlled
| project-configured URL. URL-scoped keys in [keys] are not affected.
| This issue is fixed in version 2.0.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-62364
https://www.cve.org/CVERecord?id=CVE-2026-62364
[1] https://github.com/WeblateOrg/wlc/security/advisories/GHSA-3mqq-hv9c-85hc
[2] https://github.com/WeblateOrg/wlc/pull/1500
[3] https://github.com/WeblateOrg/wlc/commit/055fd2d43d0f72418b459286245330f08176db62

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
wlc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148878@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexandre Detiste <tchet@debian.org> (supplier of updated wlc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 04 Oct 2026 11:50:44 +0200
Source: wlc
Architecture: source
Version: 2.2.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Alexandre Detiste <tchet@debian.org>
Closes: 1148878
Changes:
 wlc (2.2.1-1) unstable; urgency=medium
 .
   * New upstream version 2.2.1
     - Fix CVE-2026-62364: token leakage (Closes: #1148878)
   * Set upstream metadata fields: Documentation, Funding, Security-Contact.
Checksums-Sha1:
 341ccde92480f6f54cfda09325903854919fb307 2269 wlc_2.2.1-1.dsc
 10b7e083fa1e01c32c16829e2a07aeb607d2d359 122711 wlc_2.2.1.orig.tar.gz
 688e437baa60e4738b923744a5978d6466d0b19c 5528 wlc_2.2.1-1.debian.tar.xz
 940560dfd0b8ca71d6d0bffb8828f39a88cf089b 7244 wlc_2.2.1-1_source.buildinfo
Checksums-Sha256:
 3ecb843c0e1b5d426d09492f7fdac16728f27b0e18de5a8affff7a477c09a6f1 2269 wlc_2.2.1-1.dsc
 f1de4a39f1c363ee2050e73d9463406b29fc2010f9a7bd3a9465e94aeb2428e5 122711 wlc_2.2.1.orig.tar.gz
 dcb65d9787a16694b82e68b4f486d8a3204cbb1b248a9a95b299d15843a8cccf 5528 wlc_2.2.1-1.debian.tar.xz
 1c0afa1426771030d38bb4cb2ee5a3094bb164bbf0877664e25491a93510479d 7244 wlc_2.2.1-1_source.buildinfo
Files:
 16792200cb83415fba7065c1af608927 2269 python optional wlc_2.2.1-1.dsc
 d50603e18922d05e3c1c4ce537d4b3da 122711 python optional wlc_2.2.1.orig.tar.gz
 6e1a263bb4044e11c74eedbe60e2fb54 5528 python optional wlc_2.2.1-1.debian.tar.xz
 0566ca6d72af784b9d8d3430b589b9e9 7244 python optional wlc_2.2.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmrCIlsRHHRjaGV0QGRl
Ymlhbi5vcmcACgkQMfMURUShdBpy2w//Qyc0q5gcBr5R5+BI8lT2qPcai5ZedMp0
/rQL6P+oXWdqPbmyCkAmCnQ8obhlKRhp8VNjXNofrzInECvirxXYaNmM1eZKa44B
LC+smTEparONlKVjAj7SPFZeNj51IkV7YPpRXbOWc88xKipiKbr9nfCWHQO+DKND
pco5n4kgupjeM86//4pes+jRPyYYXzLZ+ro3zrn3nHZLOtdUrDMPf3nHYeWUSixJ
a8SNBlrN3ekI5caMSHUpd5+JaPCeUtl4/Zyyr2mvnQdvmJUlDMJV+mSzssMi+Pqc
0lWYgpL0Yizv4GGAqacWFURy49VS65nGymaCNqfGMoMyPzUzXszwt/CijNFvCQk2
xbkhC4CDln2pDqlGGgQhYPwWDlivcgcw5Ly1ezu3VPFc9SPhRG88oBlGaX4giasw
rwLXu7RO5bV1CbNtyAVwUfDrC5mc+sHhx0ctZEIAglhPVPKMrX5MwTTwnd/YPkCy
RLgckdFOfNmSl5kENoSbhNQnvl+1bzfeN2irL2Q1ENNO6IcmocZCp2cS0fSrxOsJ
iYT05Kbwn+Zq7pAudoOWAGF6EgtMfQh6P53lyrkizx/+IqCYTLaWFr/2X/YImb8o
Ptl77XGf2l+YyOV9wNzAyuTqsxQy2IIOXJimpaAHcHo8ptf3E8dQ2902HBeNXWea
vdaNHvCBDHc=
=XuTw
-----END PGP SIGNATURE-----