Wagtail improper permission restriction on page translation API

Executive brief

Wagtail is an open-source content management system used to build and manage websites. A vulnerability in its Admin API allows users with "submit translations" permission to copy and view page contents that they don't have edit access to, potentially exposing sensitive page data. This bypasses intended access controls and could allow unauthorized viewing of confidential content.

Technical details

The vulnerability is an improper privilege/permission restriction (CWE-280) in Wagtail's Admin API "copy for translation" endpoint. A CMS user possessing the "submit translations" permission can exploit this endpoint to copy pages that they lack edit access to, bypassing intended authorization checks and viewing restricted page contents. The attack requires low privileges (only "submit translations" permission) and network access to the API endpoint, with no user interaction needed. An attacker can achieve unauthorized read access to confidential page data. Patches are available in Wagtail 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 and later.

Affected products

• Wagtail Wagtail < 7.0.9; >= 7.1.0 < 7.3.4; >= 7.4.0 < 7.4.3; = 8.0rc1

Timeline

• 2026-08-20: disclosed: Vulnerability disclosed via GitHub Security Advisory
• 2026-08-20: patched: Patches released in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2

References

• https://api.github.com/users/gasman
• https://github.com/gasman
• https://api.github.com/users/gasman/gists%7B/gist_id%7D
• https://api.github.com/users/gasman/repos
• https://avatars.githubusercontent.com/u/85097?v=4
• https://api.github.com/users/gasman/events%7B/privacy%7D