Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-123819 EUVD-2026-120456

Wagtail: Improper permission handling when copying snippets

Published Nov 9, 2026 · Updated Nov 13, 2026 · Assigned by GitHub_M

Description

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Affected products

VendorProductAffectedFixed
wagtail wagtail < 7.0.9, >= 7.1, < 7.3.4, >= 7.4, < 7.4.3, = 8.0rc1 —

References