CVE-2026-54262
Wagtail: Pages translations can be created without page permissions when using simple_translation
Summary
### Impact A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. ### Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. ### Workarounds N/A ### Acknowledgements Many thanks to @devansh3008 and @alanturing881 for reporting this issue. ### For more information If you have any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Email us at [[email protected]](mailto:[email protected]) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| PyPI | wagtail | — | 7.0.8, 7.3.3, 7.4.2 |
Remediation: Upgrade to 7.0.8 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.