CVE-2026-54262
### Impact A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. ### Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. ### Workarounds N/A ### Acknowledgements Many thanks to @devansh3008 and @alanturing881 for reporting this issue. ### For more information If you have any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Email us at [[email protected]](mailto:[email protected]) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
Properties
- ghsa_id
- GHSA-8634-mr4j-r72c
- severity
- medium
- summary
- Wagtail: Pages translations can be created without page permissions when using simple_translation
- cvss_score
- 4.3
- cve_id
- CVE-2026-54262
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- is_ghsa_only
- false
- ghsa_published
- 2026-08-20T18:40:22Z
- source_url
- https://github.com/advisories/GHSA-8634-mr4j-r72c
- ghsa_updated
- 2026-08-20T18:40:24Z
Related Entities (4)
HAS_WEAKNESS (1)
REPORTED_BY (1)
VULNERABLE_TO (1)
AFFECTS (1)
Explore deeper with Ninja Signal's threat intelligence graph