Executive brief
Wagtail is a popular Django-based CMS used to manage website content and permissions. A permission bypass vulnerability allows low-level translators to create translations for any page in the system, including those they have no authorization to access. This could expose sensitive draft content or allow translators to make unauthorized changes to content they should not be able to modify.
Technical details
This is a privilege escalation vulnerability in Wagtail's simple_translation feature that stems from improper handling of permissions (CWE-280). A user with only the "Can submit translation" permission can bypass page-level access controls to create translations for any page in the system, regardless of whether they have been granted permission to view or edit that specific page. The vulnerability is network-accessible and requires only low-level authentication (the translator role); no additional user interaction is needed. An attacker can exploit this to read sensitive page content or create unauthorized translations. Patches are available in Wagtail 7.0.8, 7.3.3, and 7.4.2.
Affected products
- Wagtail Wagtail < 7.0.8, >= 7.1 < 7.3.3, >= 7.4 < 7.4.2
Timeline
- 2026-06-15: disclosed: Published by Wagtail on GitHub
- 2026-08-20: advisory: GitHub Advisory Database updated
- 2026-06-15: patched: Patches released in versions 7.0.8, 7.3.3, 7.4.2