{"id":"CVE-2026-123819","kind":"vulnerability","aliases":["CVE-2026-123819","GHSA-x5cx-w6p2-mxf2"],"related":[],"title":"Wagtail: Improper permission handling when copying snippets","description":"### Impact\nA CMS user with \"add\" permission over a snippet model, but not \"change\" or \"view\" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).","summary":"Wagtail is a Python content management system. A user who has only \"add\" permission on a snippet model, without \"change\" or \"view\" permission, can copy an existing snippet they are not allowed to see and read its contents.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wagtail","fixed":["7.0.9"],"affected":"< 7.0.9","ecosystem":"pypi"},{"name":"wagtail","fixed":["7.3.4"],"affected":">= 7.1, < 7.3.4","ecosystem":"pypi"},{"name":"wagtail","fixed":["7.4.3"],"affected":">= 7.4, < 7.4.3","ecosystem":"pypi"},{"name":"wagtail","fixed":["8.0rc2"],"affected":"= 8.0rc1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-280","package","python","self-hosted","wagtail"],"not_affected_if":["no-snippet-add-only-permissions","patched-version"],"how_to_check":"- Check the installed version with `pip show wagtail`\n- Compare it against the affected ranges: below `7.0.9`, `7.1` to below `7.3.4`, `7.4` to below `7.4.3`, and `8.0rc1`\n- Look for custom snippet permission groups that grant \"add\" without \"view\" or \"change\"","fix":"- Wagtail `7.0.9` for the 7.0 line\n- Wagtail `7.3.4` for the 7.3 line\n- Wagtail `7.4.3` for the 7.4 line\n- Wagtail `8.0rc2` for the 8.0 pre-release line","status":"open","published_at":"2026-08-20T18:45:23+00:00","first_seen_at":"2026-11-09T21:24:42+00:00","triaged_at":"2026-11-09T21:25:13+00:00","updated_at":"2026-11-09T21:25:13+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T21:25:13Z","model":"claude-haiku-5-5","output":{"fix":"- Wagtail `7.0.9` for the 7.0 line\n- Wagtail `7.3.4` for the 7.3 line\n- Wagtail `7.4.3` for the 7.4 line\n- Wagtail `8.0rc2` for the 8.0 pre-release line","reach":"network","title":"Wagtail: a user with add-only rights can view snippets they cannot access","impact":"medium","summary":"Wagtail is a Python content management system. A user who has only \"add\" permission on a snippet model, without \"change\" or \"view\" permission, can copy an existing snippet they are not allowed to see and read its contents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wagtail","python","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"a low-privilege CMS user reads contents of restricted snippets","analyst_note":"","how_to_check":"- Check the installed version with `pip show wagtail`\n- Compare it against the affected ranges: below `7.0.9`, `7.1` to below `7.3.4`, `7.4` to below `7.4.3`, and `8.0rc1`\n- Look for custom snippet permission groups that grant \"add\" without \"view\" or \"change\"","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-snippet-add-only-permissions","patched-version"],"who_is_affected":"Sites running Wagtail where some users have snippet \"add\" permission without \"view\" or \"change\" permission on the same snippet model. Sites that give every editor full snippet permissions, or that do not use snippets, are less exposed. The sources do not say whether a default configuration is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000805,"input_tokens":4899,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123819':10A,18A '-2026':9A,17A '-280':24B '/en/stable/support.html)':149C '/wagtail/wagtail/security/policy)':162C '7.0.9':112C '7.3.4':113C '7.4.3':114C '8.0':116C 'access':96C 'acknowledg':120C 'add':43B,74C 'advisori':141C 'allow':62B,98C 'chang':50B,82C 'channel':146C 'cms':71C 'comment':138C 'content':35B,68B,103C 'copi':6A,55B,87C 'could':86C 'cve':8A,16A 'cwe':23B 'docs.wagtail.org':148C 'docs.wagtail.org/en/stable/support.html)':147C 'email':150C 'exist':57B,89C 'ghsa':12A 'ghsa-x5cx-w6p2-mxf2':11A 'github.com':161C 'github.com/wagtail/wagtail/security/policy)':160C 'handl':4A 'host':29B 'impact':69C 'improp':2A 'inform':131C,165C 'issu':128C 'mailto':154C 'manag':36B 'mani':121C 'model':48B,79C 'mxf2':15A 'n/a':119C 'packag':25B 'patch':104C,105C 'permiss':3A,44B,53B,75C,85C 'polici':159C 'python':26B,34B 'question':136C 'rc2':117C 'read':66B 'releas':109C 'report':126C 'secur':158C 'security@wagtail.org':153C,155C 'see':64B 'self':28B 'self-host':27B 'snippet':7A,47B,58B,78C,90C 'support':145C 'system':37B 'thank':122C 'tinyb0y':124C 'us':151C 'user':39B,72C 'version':106C 'view':52B,84C,101C,156C 'visit':142C 'w6p2':14A 'wagtail':1A,19A,20A,21A,22A,30B,31B,111C,143C 'without':49B 'workaround':118C 'x5cx':13A","nicknames":[],"mitigations":[],"who_affected":"Sites running Wagtail where some users have snippet \"add\" permission without \"view\" or \"change\" permission on the same snippet model. Sites that give every editor full snippet permissions, or that do not use snippets, are less exposed. The sources do not say whether a default configuration is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wagtail"],"ptokens":["wagtail"],"labels":["cwe280","medium","package","pypi","python","selfhosted","wagtail"],"campaign_type":null,"search_a":"'-123819':10A,18A '-2026':9A,17A 'copi':6A 'cve':8A,16A 'ghsa':12A 'ghsa-x5cx-w6p2-mxf2':11A 'handl':4A 'improp':2A 'mxf2':15A 'permiss':3A 'snippet':7A 'w6p2':14A 'wagtail':1A,19A,20A,21A,22A 'x5cx':13A","search_b":"'-280':24B 'add':43B 'allow':62B 'chang':50B 'content':35B,68B 'copi':55B 'cwe':23B 'exist':57B 'host':29B 'manag':36B 'model':48B 'packag':25B 'permiss':44B,53B 'python':26B,34B 'read':66B 'see':64B 'self':28B 'self-host':27B 'snippet':47B,58B 'system':37B 'user':39B 'view':52B 'wagtail':30B,31B 'without':49B","search_c":"'/en/stable/support.html)':149C '/wagtail/wagtail/security/policy)':162C '7.0.9':112C '7.3.4':113C '7.4.3':114C '8.0':116C 'access':96C 'acknowledg':120C 'add':74C 'advisori':141C 'allow':98C 'chang':82C 'channel':146C 'cms':71C 'comment':138C 'content':103C 'copi':87C 'could':86C 'docs.wagtail.org':148C 'docs.wagtail.org/en/stable/support.html)':147C 'email':150C 'exist':89C 'github.com':161C 'github.com/wagtail/wagtail/security/policy)':160C 'impact':69C 'inform':131C,165C 'issu':128C 'mailto':154C 'mani':121C 'model':79C 'n/a':119C 'patch':104C,105C 'permiss':75C,85C 'polici':159C 'question':136C 'rc2':117C 'releas':109C 'report':126C 'secur':158C 'security@wagtail.org':153C,155C 'snippet':78C,90C 'support':145C 'thank':122C 'tinyb0y':124C 'us':151C 'user':72C 'version':106C 'view':84C,101C,156C 'visit':142C 'wagtail':111C,143C 'workaround':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-20T18:45:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-x5cx-w6p2-mxf2","url":"https://github.com/advisories/GHSA-x5cx-w6p2-mxf2","severity":"medium","published_at":"2026-08-20T18:45:23+00:00","modified_at":"2026-11-09T21:22:25+00:00","first_seen_at":"2026-11-09T21:24:42+00:00","fetched_at":"2026-11-09T21:29:57+00:00","note":null}],"documents":[{"id":110076,"url":"https://api.github.com/repos/wagtail/wagtail/security-advisories/GHSA-x5cx-w6p2-mxf2","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110077,"url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}