Access Control Flaw in Wagtail CMS by Wagtail
CVE-2026-125106
6.5MEDIUM
What is CVE-2026-125106?
Wagtail, an open source content management system built on Django, has an access control vulnerability that allows users with translation submit permissions to copy source pages they cannot edit through the Admin API. This flaw enables unauthorized access to otherwise restricted content, potentially compromising the integrity of the content management system. The issue has been addressed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, ensuring that permissions are enforced properly.
Affected Version(s)
wagtail < 7.0.9 < 7.0.9
wagtail >= 7.1, < 7.3.4 < 7.1, 7.3.4
wagtail >= 7.4, < 7.4.3 < 7.4, 7.4.3