Tolgee Platform
Approved changes feed: RSS · Atom
cpe:2.3:a:tolgee:tolgee-platform:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Tolgee (1fe457d7-8eb4-5884-97ee-e85a2dbd9d60) |
|---|---|
| Product | Tolgee Platform (4e8bde26-396f-59c9-8296-6c88afd031d4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-32251 |
vulnerable | 2026-06-08 07:57:17.308338 |
Tolgee has an XXE Injection in Translation Import
Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable external entity processing. An authenticated user who can import translation files into a project can exploit this to read arbitrary files from the server and make server-side requests to internal services. This vulnerability is fixed in 3.166.3.
Published: 2026-03-12T19:21:05.130Z
Updated: 2026-03-13T16:15:44.484Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52297 |
vulnerable | 2026-06-08 06:52:14.742801 |
Tolgee's configuration all configuration properties leaked in public configuration DTO
CRITICAL (9.8)
Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users. This vulnerability is fixed in v3.81.2.
Published: 2024-11-12T15:54:29.775Z
Updated: 2024-11-12T18:37:23.313Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32470 |
vulnerable | 2026-06-08 06:35:33.177095 |
Tolgee' API keys created by server admin users bypass the permission check
MEDIUM (6.5)
Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.
Published: 2024-04-18T15:05:26.408Z
Updated: 2024-08-02T02:13:39.286Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-32466 |
vulnerable | 2026-06-08 06:35:33.171223 |
Tolgee's API key scopes not checked when querying translation data
LOW (2.7)
Tolgee is an open-source localization platform. For the `/v2/projects/translations` and `/v2/projects/{projectId}/translations` endpoints, translation data was returned even when API key was missing `translation.view` scope. However, it was impossible to fetch the data when user was missing this scope. So this is only relevant for API keys generated by users permitted to `translation.view`. This vulnerability is fixed in v3.57.2
Published: 2024-04-18T15:02:43.803Z
Updated: 2024-08-02T02:13:39.097Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41316 |
vulnerable | 2026-06-08 06:11:05.921485 |
HTML Injection with email in Tolgee
MEDIUM (5.5)
Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitation emails which appear as legitimate org invitations. Bad actors may direct users to malicious website or execute javascript in the context of the users browser. This vulnerability has been addressed in version 3.29.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2023-09-07T19:39:07.916Z
Updated: 2024-09-26T14:12:50.570Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38510 |
vulnerable | 2026-06-08 06:08:18.131729 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.