CVE-2026-125106— Wagtail: Improper restriction handling on Page translation API endpoint

Quick assessment

Affected

wagtail wagtail

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wagtail 是一个基于 Django 构建的开源内容管理系统。在版本 7.0.9、7.3.4、7.4.3 和 8.0rc2 之前，拥有“提交翻译”权限的 Wagtail CMS 用户可以针对其无权编辑的源页面调用管理 API 中的“复制以进行翻译”操作。该操作会将无法访问的页面复制到翻译版本中，导致用户即使缺少对源页面的编辑权限，也能查看其内容。此问题已在版本 7.0.9、7.3.4、7.4.3 和 8.0rc2 中修复。

CVSS 6.5 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1548 · Abuse Elevation Control Mechanism T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wagtail: Improper restriction handling on Page translation API endpoint

Source: CVE Program / CVE List V5

Vulnerability Description

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不充分权限或特权的处理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wagtail	wagtail	< 7.0.9	-

II. Public POCs for CVE-2026-125106

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125106

请登录查看更多情报信息。

Other References for CVE-2026-125106 (9)

https://github.com/wagtail/wagtail/releases/tag/v7.4.3 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v7.0.9 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v7.3.4 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v8.0rc2 x_refsource_MISC
https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g x_refsource_CONFIRM
https://github.com/wagtail/wagtail/commit/344ef54f6c2fa8c03921125ee46697d319fdc652 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/3c28e5ac3b1cd12eeb9a3a23e0949e7786305b2e x_refsource_MISC
https://github.com/wagtail/wagtail/commit/1fcf3ce3dbd6cfd54980a28fd61bd1de03ce819d x_refsource_MISC
https://github.com/wagtail/wagtail/commit/ac853cfb575ccd6868e7454f26064b8f3daabd4a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-125106

Same Patch Batch · wagtail · 2026-11-09 · 4 CVEs total

CVE-2026-123819	6.5 MEDIUM	Wagtail: Improper permission handling when copying snippets
CVE-2026-123820	5.3 MEDIUM	Wagtail: Improper restriction handling on descendant collections in Documents and Images A
CVE-2026-125105	3.7 LOW	Wagtail: Identification of documents by SHA1 hash

IV. Related Vulnerabilities

Same product: wagtail

Same vendor: wagtail

Same weakness: CWE-280