Live › vulnerability › GHSA-jm5p-837g-rv8g
Go to dashboardWagtail's Admin API copy-for-translation endpoint does not check edit permission on the source page. A CMS user holding only the submit-translations permission can copy a page they cannot edit and read its contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:52 UTC. All times on this page are UTC.
Sites running Wagtail with translation features and users granted the "submit translations" permission, where some pages are restricted from those users. Sites without translation workflows or without such users are less exposed. The sources do not say whether default configurations enable the vulnerable endpoint.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wagtail | pypi | < 7.0.9 | 7.0.9 |
| wagtail | pypi | = 8.0rc1 | 8.0rc2 |
| wagtail | pypi | >= 7.1rc1, < 7.3.4 | 7.3.4 |
| wagtail | pypi | >= 7.4rc1, < 7.4.3 | 7.4.3 |
pip show wagtail and compare the version to the fixed releases.7.0.9, 7.3.4, 7.4.3 or 8.0rc2, matching your release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
N/A
Many thanks to tinyb0y for reporting this issue.
If you have any questions or comments about this advisory:
This page as .md · .json · in your agent: get_signal("GHSA-jm5p-837g-rv8g")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.