CVE-2026-125106

EUVD-2026-120460

09.11.2026, 21:27

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-280 - Improper Handling of Insufficient Permissions or Privileges
The application does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the application in an invalid state.

References

https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g

https://github.com/wagtail/wagtail/commit/1fcf3ce3dbd6cfd54980a28fd61bd1de03ce819d

https://github.com/wagtail/wagtail/commit/344ef54f6c2fa8c03921125ee46697d319fdc652

https://github.com/wagtail/wagtail/commit/3c28e5ac3b1cd12eeb9a3a23e0949e7786305b2e

https://github.com/wagtail/wagtail/commit/ac853cfb575ccd6868e7454f26064b8f3daabd4a

https://github.com/wagtail/wagtail/releases/tag/v7.0.9

https://github.com/wagtail/wagtail/releases/tag/v7.3.4

https://github.com/wagtail/wagtail/releases/tag/v7.4.3

https://github.com/wagtail/wagtail/releases/tag/v8.0rc2