CVE-2026-44200
Unauthorized Page Copy in Wagtail CMS
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wagtail | wagtail | to 7.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-280 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Wagtail CMS versions prior to 7.0.7, 7.3.2, and 7.4. It allows a user with limited access to certain pages to copy a page they do not have permission to access into an area of the site where they do have access.
The core issue is that permission checks were only performed on the destination location of the copied page, but not on the source page itself. This means unauthorized users could copy restricted content to accessible areas.
Once copied, the user could view the contents of the restricted page and potentially publish it, bypassing intended access controls.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive or restricted content by allowing users to access pages they should not be able to view.
Additionally, it may allow unauthorized users to publish content they do not have permission to manage, potentially leading to misinformation or exposure of confidential information.
The vulnerability has a medium severity score (CVSS 6.5) with low attack complexity and requires only low privileges, making it a significant risk if exploited.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Wagtail CMS to one of the fixed versions: 7.0.7, 7.3.2, or 7.4.
These versions include patches that properly check permissions on the source page when copying, preventing unauthorized users from viewing or publishing restricted content.