Wagtail: Improper restriction handling on Page translation API endpoint
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. ### Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. ### Workarounds N/A ### Acknowledgements Many thanks to tinyb0y for reporting this issue. ### For more information If you have any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Email us at [[email protected]](mailto:[email protected]) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | wagtail (PyPI) | before 7.0.9 | 7.0.9 | Patch available | GHSA-jm5p-837g-rv8g |
| — | wagtail (PyPI) | 7.1rc1 to before 7.3.4 | 7.3.4 | Patch available | GHSA-jm5p-837g-rv8g |
| — | wagtail (PyPI) | 7.4rc1 to before 7.4.3 | 7.4.3 | Patch available | GHSA-jm5p-837g-rv8g |
| — | wagtail (PyPI) | 8.0rc1 to before 8.0rc2 | 8.0rc2 | Patch available | GHSA-jm5p-837g-rv8g |
- wagtail (PyPI) Vendor— Affected before 7.0.9 Fixed in 7.0.9 Patch available GHSA-jm5p-837g-rv8g
- wagtail (PyPI) Vendor— Affected 7.1rc1 to before 7.3.4 Fixed in 7.3.4 Patch available GHSA-jm5p-837g-rv8g
- wagtail (PyPI) Vendor— Affected 7.4rc1 to before 7.4.3 Fixed in 7.4.3 Patch available GHSA-jm5p-837g-rv8g
- wagtail (PyPI) Vendor— Affected 8.0rc1 to before 8.0rc2 Fixed in 8.0rc2 Patch available GHSA-jm5p-837g-rv8g
Remediation
- Fix · GHSA-jm5p-837g-rv8g wagtail (PyPI) Fixed in 7.0.9 Advisory →
- Fix · GHSA-jm5p-837g-rv8g wagtail (PyPI) Fixed in 7.3.4 Advisory →
- Fix · GHSA-jm5p-837g-rv8g wagtail (PyPI) Fixed in 7.4.3 Advisory →
- Fix · GHSA-jm5p-837g-rv8g wagtail (PyPI) Fixed in 8.0rc2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-jm5p-837g-rv8g
References
Other 6
- https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g
- https://github.com/wagtail/wagtail
- https://github.com/wagtail/wagtail/releases/tag/v7.0.9
- https://github.com/wagtail/wagtail/releases/tag/v7.3.4
- https://github.com/wagtail/wagtail/releases/tag/v7.4.3
- https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences