{"id":"GHSA-jm5p-837g-rv8g","kind":"vulnerability","aliases":["GHSA-jm5p-837g-rv8g"],"related":[],"title":"Wagtail: Improper restriction handling on Page translation API endpoint","description":"### Impact\nA CMS user with the \"submit translations\" permission, could use the Admin API's \"copy for translation\" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).","summary":"Wagtail's Admin API copy-for-translation endpoint does not check edit permission on the source page. A CMS user holding only the submit-translations permission can copy a page they cannot edit and read its contents.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wagtail","fixed":["7.0.9"],"affected":"< 7.0.9","ecosystem":"pypi"},{"name":"wagtail","fixed":["8.0rc2"],"affected":"= 8.0rc1","ecosystem":"pypi"},{"name":"wagtail","fixed":["7.3.4"],"affected":">= 7.1rc1, < 7.3.4","ecosystem":"pypi"},{"name":"wagtail","fixed":["7.4.3"],"affected":">= 7.4rc1, < 7.4.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cms","cwe-280","package","python","self-hosted","wagtail"],"not_affected_if":["no-translation-permission-users","version-patched"],"how_to_check":"- Run `pip show wagtail` and compare the version to the fixed releases.\n- Check whether users with the \"submit translations\" permission are also used for content review or restricted pages.","fix":"- Upgrade wagtail to `7.0.9`, `7.3.4`, `7.4.3` or `8.0rc2`, matching your release line.","status":"open","published_at":"2026-08-20T18:45:27+00:00","first_seen_at":"2026-10-26T14:52:20+00:00","triaged_at":"2026-10-26T14:52:49+00:00","updated_at":"2026-10-26T14:52:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T14:52:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade wagtail to `7.0.9`, `7.3.4`, `7.4.3` or `8.0rc2`, matching your release line.","reach":"internet","title":"Wagtail: a translator can copy pages they cannot edit","impact":"medium","summary":"Wagtail's Admin API copy-for-translation endpoint does not check edit permission on the source page. A CMS user holding only the submit-translations permission can copy a page they cannot edit and read its contents.","category":"package","nicknames":[],"who_cares":["wagtail","python","self-hosted","cms"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated editor reads contents of restricted pages they cannot edit.","analyst_note":"","how_to_check":"- Run `pip show wagtail` and compare the version to the fixed releases.\n- Check whether users with the \"submit translations\" permission are also used for content review or restricted pages.","needs_analyst":false,"not_affected_if":["no-translation-permission-users","version-patched"],"who_is_affected":"Sites running Wagtail with translation features and users granted the \"submit translations\" permission, where some pages are restricted from those users. Sites without translation workflows or without such users are less exposed. The sources do not say whether default configurations enable the vulnerable endpoint.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00061,"input_tokens":3634,"output_tokens":493,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-280':26B '/en/stable/support.html)':155C '/wagtail/wagtail/security/policy)':168C '7.0.9':118C '7.3.4':119C '7.4.3':120C '8.0':122C '837g':13A,18A 'access':102C 'acknowledg':126C 'admin':35B,84C 'advisori':147C 'allow':104C 'api':8A,36B,85C 'cannot':66B 'channel':152C 'check':44B 'cms':24B,52B,74C 'comment':144C 'content':71B,109C 'copi':38B,62B,87C,92C 'copy-for-transl':37B 'could':81C 'cwe':25B 'docs.wagtail.org':154C 'docs.wagtail.org/en/stable/support.html)':153C 'edit':45B,67B,101C 'email':156C 'endpoint':9A,41B,90C 'exist':94C 'ghsa':11A,16A 'ghsa-jm5p-837g-rv8g':10A,15A 'github.com':167C 'github.com/wagtail/wagtail/security/policy)':166C 'handl':4A 'hold':54B 'host':31B 'impact':72C 'improp':2A 'inform':137C,171C 'issu':134C 'jm5p':12A,17A 'mailto':160C 'mani':127C 'n/a':125C 'packag':27B 'page':6A,50B,64B,95C 'patch':110C,111C 'permiss':46B,60B,80C 'polici':165C 'python':28B 'question':142C 'rc2':123C 'read':69B 'releas':115C 'report':132C 'restrict':3A 'rv8g':14A,19A 'secur':164C 'security@wagtail.org':159C,161C 'self':30B 'self-host':29B 'sourc':49B 'submit':58B,78C 'submit-transl':57B 'support':151C 'thank':128C 'tinyb0y':130C 'translat':7A,40B,59B,79C,89C 'us':157C 'use':82C 'user':53B,75C 'version':112C 'view':107C,162C 'visit':148C 'wagtail':1A,20A,21A,22A,23A,32B,33B,117C,149C 'workaround':124C","nicknames":[],"mitigations":[],"who_affected":"Sites running Wagtail with translation features and users granted the \"submit translations\" permission, where some pages are restricted from those users. Sites without translation workflows or without such users are less exposed. The sources do not say whether default configurations enable the vulnerable endpoint.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-20T18:45:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jm5p-837g-rv8g","url":"https://github.com/advisories/GHSA-jm5p-837g-rv8g","severity":"medium","published_at":"2026-08-20T18:45:27+00:00","modified_at":"2026-10-26T14:47:42+00:00","first_seen_at":"2026-10-26T14:52:20+00:00","fetched_at":"2026-10-26T14:52:20+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}