{"items":[{"id":"NVI-00010088","kind":"vulnerability","title":"Wagtail: Improper restriction handling on Page translation API endpoint","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jm5p-837g-rv8g"],"plain_summary":"GitHub lists this reviewed advisory for wagtail, wagtail, wagtail, wagtail. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0223bc1d714125e6323e358df7fd4534"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T14:47:42.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0223bc1d714125e6323e358df7fd4534"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0223bc1d714125e6323e358df7fd4534","url":"https://github.com/advisories/GHSA-jm5p-837g-rv8g","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jm5p-837g-rv8g","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0223bc1d714125e6323e358df7fd4534"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nA CMS user with the \"submit translations\" permission, could use the Admin API's \"copy for translation\" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's support channels\n* Email us at security@wagtail.org (view our security policy for more information).","public_affected_ranges":["< 7.0.9"]},{"certainty":"source_listed","source_ids":["sr-0223bc1d714125e6323e358df7fd4534"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nA CMS user with the \"submit translations\" permission, could use the Admin API's \"copy for translation\" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's support channels\n* Email us at security@wagtail.org (view our security policy for more information).","public_affected_ranges":["= 8.0rc1"]},{"certainty":"source_listed","source_ids":["sr-0223bc1d714125e6323e358df7fd4534"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nA CMS user with the \"submit translations\" permission, could use the Admin API's \"copy for translation\" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's support channels\n* Email us at security@wagtail.org (view our security policy for more information).","public_affected_ranges":[">= 7.1rc1, < 7.3.4"]},{"certainty":"source_listed","source_ids":["sr-0223bc1d714125e6323e358df7fd4534"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nA CMS user with the \"submit translations\" permission, could use the Admin API's \"copy for translation\" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's support channels\n* Email us at security@wagtail.org (view our security policy for more information).","public_affected_ranges":[">= 7.4rc1, < 7.4.3"]}],"null_published_at":"2026-10-31T22:13:48.414Z","source_updated_at":"2026-10-26T14:47:42.000Z","source_disclosed_at":"2026-08-20T18:45:27.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:46.371Z"}],"next_cursor":null,"snapshot_revision":"42594"}