CVE-2026-54262CWE-280

Wagtail: Pages translations can be created without page permissions when using simple_translation

Medium · published July 1, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2026-07-01T21:11Z
EPSS history
Timeline
  • 01 JUL 21:11Z
    Wagtail: Pages translations can be created without page permissions when using simple_translation
    cvelistv5