Every CVE Search/ Get API key

CVE-2026-125106

Wagtail: Improper restriction handling on Page translation API endpoint

6.5 MediumFix available

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.31%Scored on 2026-11-10. The trend appears after a second daily score.

What each source reports

CVE List Score used 6.5

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Record
CVE-2026-125106
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-280
Updated
2026-11-09
EUVDEUVD-2026-120460 6.5

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Record
EUVD-2026-120460
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-09
GitHub AdvisoriesGHSA-jm5p-837g-rv8g 6.5

Wagtail: Improper restriction handling on Page translation API endpoint

Impact

A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

N/A

Acknowledgements

Many thanks to tinyb0y for reporting this issue.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-jm5p-837g-rv8g
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-280
Updated
2026-11-09
NVD 6.5

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Record
CVE-2026-125106
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-280
Updated
2026-11-09
OSV 6.5

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Record
CVE-2026-125106
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-280
Updated
2026-11-10
OSVGHSA-jm5p-837g-rv8g 6.5

Wagtail: Improper restriction handling on Page translation API endpoint

Impact

A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

N/A

Acknowledgements

Many thanks to tinyb0y for reporting this issue.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-jm5p-837g-rv8g
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-280
Updated
2026-11-09

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wagtail
PyPI
 before 7.0.9
7.0.9
wagtail
PyPI
 8.0rc1 to 8.0rc1
8.0rc2
wagtail
PyPI
 7.1rc1 up to 7.3.4
7.3.4
wagtail
PyPI
 7.4rc1 up to 7.4.3
7.4.3
wagtail
PyPI
 before 7.0.9, plus listed versions
0.10.20.30.3.10.4
Show 45 moreShow less
0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3
7.0.9
wagtail
PyPI
 7.1rc1 up to 7.3.4, plus listed versions
7.17.1.17.1.27.1.37.2
Show 9 moreShow less
7.2.17.2.27.2.37.2rc17.37.3.17.3.27.3.37.3rc1
7.3.4
wagtail
PyPI
 7.4rc1 up to 7.4.3, plus listed versions
7.47.4.17.4.2
7.4.3
wagtail
PyPI
 8.0rc1 up to 8.0rc2
8.0rc2

History

History
RecordedChangedSources
referencesNVD, OSV
description, references, severityCVE List
aliases, products, referencesEUVD, OSV
aliases, facts, idGitHub Advisories
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-125106 is a medium vulnerability (CVSS 6.5) in Wagtail, published August 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in wagtail 7.0.9.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 225 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open