CVE-2026-123819— Wagtail: Improper permission handling when copying snippets

Quick assessment

Affected

wagtail wagtail

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wagtail 是一个基于 Django 构建的开源内容管理系统。在版本 7.0.9、7.3.4、7.4.3 和 8.0rc2 之前，若某 CMS 用户拥有对某个片段（snippet）模型的“添加”权限，但缺乏对已有片段的“修改”和“查看”权限，该用户仍可访问片段的“复制”视图并复制源对象。此复制操作会泄露该用户无权查看的片段内容。该问题已在版本 7.0.9、7.3.4、7.4.3 和 8.0rc2 中修复。

CVSS 6.5 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wagtail: Improper permission handling when copying snippets

Source: CVE Program / CVE List V5

Vulnerability Description

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不充分权限或特权的处理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wagtail	wagtail	< 7.0.9	-

II. Public POCs for CVE-2026-123819

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123819

请登录查看更多情报信息。

Other References for CVE-2026-123819 (9)

https://github.com/wagtail/wagtail/releases/tag/v7.4.3 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v7.0.9 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v7.3.4 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v8.0rc2 x_refsource_MISC
https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2 x_refsource_CONFIRM
https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be x_refsource_MISC
https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c x_refsource_MISC
https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-123819

Same Patch Batch · wagtail · 2026-11-09 · 4 CVEs total

CVE-2026-125106	6.5 MEDIUM	Wagtail: Improper restriction handling on Page translation API endpoint
CVE-2026-123820	5.3 MEDIUM	Wagtail: Improper restriction handling on descendant collections in Documents and Images A
CVE-2026-125105	3.7 LOW	Wagtail: Identification of documents by SHA1 hash

IV. Related Vulnerabilities

Same product: wagtail

Same vendor: wagtail

Same weakness: CWE-280