# CVE-2026-123819: Wagtail snippet copy permission bypass

Source: https://junglewise.ai/threats/cve-2026-123819-wagtail-is-an-open-source-content-management-system-built-on  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-123819 · Severity: medium · CVSS 6.5 · Published 2026-11-09

Wagtail is a Django-based content management system that manages website content through user roles and permissions. A CMS user with permission to create snippets but not view existing ones could bypass access controls by copying a snippet, revealing its contents. This allows unauthorized access to sensitive content such as reusable text, media, or configuration data that should be restricted.

Technologies: [Wagtail](https://junglewise.ai/threats/technologies/wagtail). Vendors: [Wagtail](https://junglewise.ai/threats/vendors/wagtail).

## Quick answers

**Is CVE-2026-123819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123819 being exploited in the wild.

**How severe is CVE-2026-123819?** Medium severity, with a CVSS score of 6.5, published 9 November 2026.

**Which products and versions are affected?** Wagtail Before 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

**Is there a fix for CVE-2026-123819?** Yes: fixed in 7.0.9, 7.3.4, 7.4.3, 8.0rc2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123819 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123819?** Check whether you run Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.0.9, 7.3.4, 7.4.3, 8.0rc2

## Technical details

The CopyViewMixin in Wagtail's admin views failed to validate view or change permissions on the source object before allowing a copy operation. An authenticated CMS user with add permission for a snippet model but lacking change and view permissions for a specific snippet instance could access the copy view and retrieve the snippet's full contents. The fix adds permission checks (user_has_any_permission_for_instance) in the get_object method to enforce change or view permission requirements.

## Affected products

- Wagtail Wagtail Before 7.0.9, 7.3.4, 7.4.3, and 8.0rc2

## Timeline

- 2026-11-09: disclosed

## References

- [https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4](https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4)
- [https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be](https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be)

## Related threats

- [Wagtail permission bypass in copy page for translation](https://junglewise.ai/threats/cve-2026-125106-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Documents and Images API access control bypass](https://junglewise.ai/threats/cve-2026-123820-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Pages admin API improper access control](https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control)
- [Wagtail improper permission restriction on page translation API](https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804)
- [Wagtail improper permission handling when copying snippets](https://junglewise.ai/threats/wagtail-improper-permission-handling-when-copying-snippets-7cffb199)