Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-125106

Wagtail: Improper restriction handling on Page translation API endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

wagtail wagtail

  • < 7.0.9affected
  • >= 7.1, < 7.3.4affected
  • >= 7.4, < 7.4.3affected
  • = 8.0rc1affected

References