Executive brief
Wagtail, a popular content management system, contains a flaw in how it handles page permissions during the copy process. An authorized user with limited access could bypass security restrictions to copy and view sensitive pages they are not normally allowed to see. This could lead to the unauthorized disclosure of private content or the accidental publication of restricted information.
Technical details
An improper permission handling vulnerability (CWE-280) exists in Wagtail's page copying functionality. While the system correctly validates permissions for the destination of a copy operation, it fails to verify if the user has sufficient privileges to access the source page. A remote attacker with basic CMS access (PR:L) can exploit this to copy restricted pages into a directory they control, thereby gaining unauthorized read access to the content and the ability to publish it. The issue is resolved in versions 7.0.7, 7.3.2, and 7.4 LTS.
Affected products
- Wagtail Wagtail < 7.0.7, >= 7.1, < 7.3.2
Timeline
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-08: disclosed
- 2026-05-08: patched