# CVE-2026-44200: Wagtail improper permission handling in page copying

Source: https://junglewise.ai/threats/cve-2026-44200-wagtail-improper-permission-handling-in-page-copying  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-44200 · Severity: medium · CVSS 6.5 · Published 2026-05-11

Wagtail, a popular content management system, contains a flaw in how it handles page permissions during the copy process. An authorized user with limited access could bypass security restrictions to copy and view sensitive pages they are not normally allowed to see. This could lead to the unauthorized disclosure of private content or the accidental publication of restricted information.

Technologies: [wagtail (PyPI)](https://junglewise.ai/threats/technologies/pypi-wagtail), [Wagtail](https://junglewise.ai/threats/technologies/wagtail). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Wagtail](https://junglewise.ai/threats/vendors/wagtail).

## Quick answers

**Is CVE-2026-44200 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44200 being exploited in the wild.

**How severe is CVE-2026-44200?** Medium severity, with a CVSS score of 6.5, published 11 May 2026.

**Which products and versions are affected?** wagtail (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.7, ECOSYSTEM:introduced=0,fixed=7.0.7,introduced=7.1,fixed=7.3.2; Wagtail < 7.0.7, >= 7.1, < 7.3.2, < 7.0.7, 7.1 - 7.3.1.

**Is there a fix for CVE-2026-44200?** Yes. wagtail (PyPI): upgrade to 7.0.7, 7.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44200 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44200?** Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wagtail (PyPI): upgrade to 7.0.7, 7.3.2 or later

  ```sh
  pip install "wagtail>=7.3.2"
  ```


## Technical details

An improper permission handling vulnerability (CWE-280) exists in Wagtail's page copying functionality. While the system correctly validates permissions for the destination of a copy operation, it fails to verify if the user has sufficient privileges to access the source page. A remote attacker with basic CMS access (PR:L) can exploit this to copy restricted pages into a directory they control, thereby gaining unauthorized read access to the content and the ability to publish it. The issue is resolved in versions 7.0.7, 7.3.2, and 7.4 LTS.

## Affected products

- Wagtail Wagtail < 7.0.7, >= 7.1, < 7.3.2

## Identifiers

- CVE-2026-44200
- GHSA-67rv-mg8q-5pf3
- PYSEC-2026-149

## Timeline

- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-08: disclosed
- 2026-05-08: patched

## References

- [https://api.github.com/users/RealOrangeOne](https://api.github.com/users/RealOrangeOne)
- [https://github.com/RealOrangeOne](https://github.com/RealOrangeOne)
- [https://api.github.com/users/RealOrangeOne/gists%7B/gist_id%7D](https://api.github.com/users/RealOrangeOne/gists%7B/gist_id%7D)
- [https://api.github.com/users/RealOrangeOne/repos](https://api.github.com/users/RealOrangeOne/repos)
- [https://avatars.githubusercontent.com/u/6527489?v=4](https://avatars.githubusercontent.com/u/6527489?v=4)
- [https://api.github.com/users/RealOrangeOne/events%7B/privacy%7D](https://api.github.com/users/RealOrangeOne/events%7B/privacy%7D)

## Related threats

- [Wagtail permission bypass in copy page for translation](https://junglewise.ai/threats/cve-2026-125106-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Documents and Images API access control bypass](https://junglewise.ai/threats/cve-2026-123820-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail snippet copy permission bypass](https://junglewise.ai/threats/cve-2026-123819-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Pages admin API improper access control](https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control)
- [Wagtail improper permission restriction on page translation API](https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804)