~ / search / GHSA-8634-mr4j-r72c

GHSA-8634-mr4j-r72c

Wagtail: Pages translations can be created without page permissions when using simple_translation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-54262

Packages

EcosystemPackageAffectedFixed in
PyPI wagtail < 7.0.8 7.0.8
PyPI wagtail >= 7.1, < 7.3.3 7.3.3
PyPI wagtail >= 7.4, < 7.4.2 7.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. ### Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. ### Workarounds N/A ### Acknowledgements Many thanks to @devansh3008 and @alanturing881 for reporting this issue. ### For more information If you have any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Email us at [[email protected]](mailto:[email protected]) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).

References

External links from the advisory. They lead to third-party sites.