WAGTAIL · CVE-2026-123819 · Package
FIX → 8.0rc2 · 7.4.3 +2
Wagtail is a Python content management system. A user who has only "add" permission on a snippet model, without "change" or "view" permission, can copy an existing snippet they are not allowed to see and read its contents.
first public Aug 20, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Wagtail where some users have snippet "add" permission without "view" or "change" permission on the same snippet model. Sites that give every editor full snippet permissions, or that do not use snippets, are less exposed. The sources do not say whether a default configuration is affected.
Not affected if no-snippet-add-only-permissions, patched-version
Who cares python, self-hosted, wagtail
pip show wagtail7.0.9, 7.1 to below , to below , and A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
N/A
Many thanks to tinyb0y for reporting this issue.
If you have any questions or comments about this advisory:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
7.3.47.47.4.38.0rc1Upgrade to 8.0rc2 · 7.4.3 +2
7.0.9 for the 7.0 line7.3.4 for the 7.3 line7.4.3 for the 7.4 line8.0rc2 for the 8.0 pre-release lineGitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.