GHSA-X5CX-W6P2-MXF2: Improper Permission Handling in Wagtail Snippet Copy Functionality
Vulnerability ID: GHSA-X5CX-W6P2-MXF2
CVSS Score: 6.5
Published: 2026-08-20
An authorization bypass vulnerability in Wagtail CMS allows authenticated users with snippet creation privileges ('add') to access and view the contents of restricted snippet instances for which they lack viewing or editing permissions. By invoking the copy endpoint, the application pre-populates form data with the properties of the source snippet, exposing sensitive information to unauthorized users.
TL;DR
Low-privileged users with 'add' permissions on a snippet model can bypass read restrictions by copying arbitrary snippet IDs, exposing sensitive content.
Technical Details
- CWE ID: CWE-285
- Attack Vector: Network
- CVSS Score: 6.5
- Exploit Status: none
- KEV Status: Not listed
- Impact: Confidentiality
Affected Systems
- Wagtail Content Management System
-
Wagtail CMS: >= 0, < 7.0.9 (Fixed in:
7.0.9) -
Wagtail CMS: >= 7.1, < 7.3.4 (Fixed in:
7.3.4) -
Wagtail CMS: >= 7.4, < 7.4.3 (Fixed in:
7.4.3) -
Wagtail CMS: == 8.0rc1 (Fixed in:
8.0rc2)
Mitigation Strategies
- Enforce dual permission checks for snippet copying actions.
- Audit and limit active 'add' permissions on sensitive snippet models.
- Monitor admin access logs for sequential ID scanning.
Remediation Steps:
- Identify the current Wagtail version deployed in the environment.
- Update the requirements configuration file to reference a patched version (7.0.9, 7.3.4, 7.4.3, or 8.0rc2).
- Run pip install -r requirements.txt to apply the update.
- Restart the application services and verify the fix by attempting to copy a restricted snippet with a low-privileged account.
References
- GitHub Security Advisory GHSA-X5CX-W6P2-MXF2
- Wagtail Security Advisory Page
- Wagtail Official Repository
- Wagtail Support Channels
Read the full report for GHSA-X5CX-W6P2-MXF2 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)