GHSA-jm5p-837g-rv8gMedium· 6.5▾ SunlitWagtail: Improper restriction handling on Page translation API endpoint
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
N/A
Many thanks to tinyb0y for reporting this issue.
If you have any questions or comments about this advisory:
wagtail < 7.0.9wagtail >= 7.1rc1, < 7.3.4wagtail >= 7.4rc1, < 7.4.3wagtail >= 8.0rc1, < 8.0rc2Upgrade to a patched release:
wagtail 7.0.9wagtail 7.3.4wagtail 7.4.3wagtail 8.0rc2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55468Medium· 4.3Wagtail is an open source content management system built on Django
CVE-2021-29434Medium· 6.1Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
CVE-2023-28836Medium· 6.4Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
CVE-2023-28837Medium· 4.4Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
CVE-2020-15118Medium· 5.7Cross-Site Scripting in Wagtail
CVE-2026-28222Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes