Wagtail improper permission handling when copying snippets

Executive brief

Wagtail is a popular open-source CMS that manages digital content and permissions for editorial teams. A flaw in snippet copying allows a user with only "add" permission to access and view snippet content they should not have permission to see, potentially exposing sensitive editorial data or restricted content to unauthorized personnel.

Technical details

The vulnerability is a permission bypass (CWE-280: Improper Handling of Insufficient Permissions or Privileges) in Wagtail's snippet copy functionality. A user holding only "add" permission on a snippet model could leverage the copy operation to duplicate an existing snippet they lack "view" or "change" permission for, gaining unauthorized access to its data. The vulnerability requires low-level privileges (authenticated user with limited add permission) and network reachability to the CMS. An attacker can view restricted snippet content, though they cannot modify or delete it. Patches are available in Wagtail 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 and later.

Affected products

• Wagtail Wagtail CMS < 7.0.9, >= 7.1 and < 7.3.4, >= 7.4 and < 7.4.3, = 8.0rc1

Timeline

• 2026-08-20: disclosed: Vulnerability published on GitHub Advisory Database
• 2026-08-20: patched: Patches released: Wagtail 7.0.9, 7.3.4, 7.4.3, 8.0rc2

References

• https://api.github.com/users/gasman
• https://github.com/gasman
• https://api.github.com/users/gasman/gists%7B/gist_id%7D
• https://api.github.com/users/gasman/repos
• https://avatars.githubusercontent.com/u/85097?v=4
• https://api.github.com/users/gasman/events%7B/privacy%7D