CVE-2026-54262
Wagtail: Pages translations can be created without page permissions when using simple_translation
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Wagtail: Pages translations can be created without page permissions when using simple_translation
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Record
CVE-2026-54262- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
EUVDEUVD-2026-41149
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Record
EUVD-2026-41149- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8634-mr4j-r72c
Wagtail: Pages translations can be created without page permissions when using simple_translation
Impact
A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for.
Patches
Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
Workarounds
N/A
Acknowledgements
Many thanks to @devansh3008 and @alanturing881 for reporting this issue.
For more information
If you have any questions or comments about this advisory:
- Visit Wagtail's support channels
- Email us at [email protected] (view our security policy for more information).
- Record
GHSA-8634-mr4j-r72c- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
NVD
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Record
CVE-2026-54262- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSV
Wagtail: Pages translations can be created without page permissions when using simple_translation
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Record
CVE-2026-54262- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSVGHSA-8634-mr4j-r72c
Wagtail: Pages translations can be created without page permissions when using simple_translation
Impact
A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for.
Patches
Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
Workarounds
N/A
Acknowledgements
Many thanks to @devansh3008 and @alanturing881 for reporting this issue.
For more information
If you have any questions or comments about this advisory:
- Visit Wagtail's support channels
- Email us at [email protected] (view our security policy for more information).
- Record
GHSA-8634-mr4j-r72c- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSVPYSEC-2026-615
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Record
PYSEC-2026-615- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wagtailPyPI |
before 7.0.8 | 7.0.8 |
wagtailPyPI |
7.1 up to 7.3.3 | 7.3.3 |
wagtailPyPI |
7.4 up to 7.4.2 | 7.4.2 |
wagtailPyPI |
before 7.0.8, plus listed versions 0.10.20.30.3.10.4 Show 45 moreShow less0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3 |
7.0.8 |
wagtailPyPI |
7.1 up to 7.3.3, plus listed versions 7.1.17.1.27.1.37.27.2.1 Show 7 moreShow less7.2.27.2.37.2rc17.37.3.17.3.27.3rc1 |
7.3.3 |
wagtailPyPI |
7.4 up to 7.4.2, plus listed versions 7.4.1 |
7.4.2 |
wagtailPyPI |
before 7.0.8, 7.1 up to 7.3.3, 7.4 up to 7.4.2, plus listed versions 0.10.20.30.3.10.4 Show 45 moreShow less0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3 |
7.0.87.3.37.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54262 is a medium vulnerability (CVSS 4.3) in Torchbox Wagtail, published July 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in wagtail 7.0.8.
References
github.com/wagtail/wagtail/security/advisories/GHSA-8634-mr4j-r72c
nvd.nist.gov/vuln/detail/CVE-2026-54262
Left out here: 461 versions. The JSON record has them.