---
id: "CVE-2026-123819"
page: "https://infrastack.ai/live/CVE-2026-123819"
kind: "vulnerability"
aliases: ["CVE-2026-123819", "GHSA-x5cx-w6p2-mxf2"]
title: "Wagtail: Improper permission handling when copying snippets"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wagtail", "fixed": ["7.0.9"], "affected": "< 7.0.9", "ecosystem": "pypi"}, {"name": "wagtail", "fixed": ["7.3.4"], "affected": ">= 7.1, < 7.3.4", "ecosystem": "pypi"}, {"name": "wagtail", "fixed": ["7.4.3"], "affected": ">= 7.4, < 7.4.3", "ecosystem": "pypi"}, {"name": "wagtail", "fixed": ["8.0rc2"], "affected": "= 8.0rc1", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-280", "package", "python", "self-hosted", "wagtail"]
not_affected_if: ["no-snippet-add-only-permissions", "patched-version"]
published_at: "2026-08-20T18:45:23+00:00"
first_seen_at: "2026-11-09T21:24:42+00:00"
updated_at: "2026-11-09T21:25:13+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-x5cx-w6p2-mxf2", "first_seen_at": "2026-11-09T21:24:42+00:00"}]
exploit_sources: []
---

# Wagtail: Improper permission handling when copying snippets

Link for people: https://infrastack.ai/live/CVE-2026-123819 (this .md is for agents)

Wagtail is a Python content management system. A user who has only "add" permission on a snippet model, without "change" or "view" permission, can copy an existing snippet they are not allowed to see and read its contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:wagtail affected < 7.0.9 fixed 7.0.9
- pypi:wagtail affected >= 7.1, < 7.3.4 fixed 7.3.4
- pypi:wagtail affected >= 7.4, < 7.4.3 fixed 7.4.3
- pypi:wagtail affected = 8.0rc1 fixed 8.0rc2

## How to check

- Check the installed version with `pip show wagtail`
- Compare it against the affected ranges: below `7.0.9`, `7.1` to below `7.3.4`, `7.4` to below `7.4.3`, and `8.0rc1`
- Look for custom snippet permission groups that grant "add" without "view" or "change"

## Fix

- Wagtail `7.0.9` for the 7.0 line
- Wagtail `7.3.4` for the 7.3 line
- Wagtail `7.4.3` for the 7.4 line
- Wagtail `8.0rc2` for the 8.0 pre-release line

## Timeline

- 2026-11-09T21:24:42+00:00 ghsa https://github.com/advisories/GHSA-x5cx-w6p2-mxf2

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/wagtail/wagtail/security-advisories/GHSA-x5cx-w6p2-mxf2
- [advisory] Maintainer's advisory: github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2

## From the sources

### Impact
A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.

### Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

### Workarounds
N/A

### Acknowledgements
Many thanks to tinyb0y for reporting this issue.

### For more information
If you have any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_