GHSA-JM5P-837G-RV8G: Insecure Direct Object Reference (IDOR) in Wagtail Page Translation Endpoint
Vulnerability ID: GHSA-JM5P-837G-RV8G
CVSS Score: 6.5
Published: 2026-08-20
An authenticated user with global translation permissions can exploit a missing authorization check on the page translation endpoint in Wagtail CMS. This allows the attacker to copy and view pages they do not have explicit edit or explore access to.
TL;DR
A missing object-level permission check in Wagtail's page translation endpoint allows authenticated users with global translation rights to duplicate and read restricted pages, bypass access controls, and extract sensitive content.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-862 (Missing Authorization)
- Attack Vector: Network (AV:N)
- CVSS v3.1: 6.5 (Medium)
- Exploit Status: PoC Concepts Documented
- Vulnerability Class: IDOR / Broken Object Level Authorization (BOLA)
- Affected Component: wagtail.contrib.simple_translation
Affected Systems
- Wagtail CMS
-
wagtail: < 7.0.9 (Fixed in:
7.0.9) -
wagtail: >= 7.1, < 7.3.4 (Fixed in:
7.3.4) -
wagtail: >= 7.4, < 7.4.3 (Fixed in:
7.4.3) -
wagtail: == 8.0rc1 (Fixed in:
8.0rc2)
Mitigation Strategies
- Upgrade to a patched version of Wagtail (7.0.9, 7.3.4, 7.4.3, or 8.0rc2)
- Restrict translation submission permissions to highly trusted accounts
- Implement custom Django middleware to block unauthorized copy attempts
Remediation Steps:
- Identify current Wagtail installation version using command 'pip show wagtail'
- Update requirements file to specify patched version (7.0.9, 7.3.4, 7.4.3, or 8.0rc2)
- Deploy updated packages to staging and production environments
- Verify that low-privileged users with 'submit translations' permission can no longer copy unauthorized pages
References
Read the full report for GHSA-JM5P-837G-RV8G on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)