CVE-2026-123819: Wagtail: Improper permission handling when copying snippets
Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.
Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
Workarounds N/A
Acknowledgements Many thanks to tinyb0y for reporting this issue.
For more information If you have any questions or comments about this advisory:
Visit Wagtail's support channels Email us at security@wagtail.org (view our security policy for more information).
Other sources
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Upgrade
Upgrade
Wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
Wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
Wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
Wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2