Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
wagtail wagtail affected
Version Status Constraints
< 7.0.9 affected —
>= 7.1, < 7.3.4 affected —
>= 7.4, < 7.4.3 affected —
= 8.0rc1 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Wagtail Subscribe
Wagtail Subscribe

Project Subscriptions

Vendors Products
Wagtail Subscribe
Wagtail Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-x5cx-w6p2-mxf2 Wagtail: Improper permission handling when copying snippets
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4 cve-icon
https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be cve-icon
https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c cve-icon
https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10 cve-icon
https://github.com/wagtail/wagtail/releases/tag/v7.0.9 cve-icon
https://github.com/wagtail/wagtail/releases/tag/v7.3.4 cve-icon
https://github.com/wagtail/wagtail/releases/tag/v7.4.3 cve-icon
https://github.com/wagtail/wagtail/releases/tag/v8.0rc2 cve-icon
https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2 cve-icon
History

Mon, 09 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Wagtail
Wagtail wagtail
Vendors & Products Wagtail
Wagtail wagtail

Mon, 09 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
Title Wagtail: Improper permission handling when copying snippets
Weaknesses CWE-280
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-09T21:22:17.696Z

Reserved: 2026-11-06T15:27:56.227Z

Link: CVE-2026-123819

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T22:15:15Z

Weaknesses