CVE-2026-54262

Summary

Wagtail: Pages translations can be created without page permissions when using simple_translation

Severity

medium

CVSS

4.3

EPSS

0.3% (p19)

CWE

CWE-280

Also known as

GHSA-8634-mr4j-r72c

Published

2026-08-20

Updated

2026-08-20

Advisory details

Impact

A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for.

Patches

Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.

Workarounds

N/A

Acknowledgements

Many thanks to @devansh3008 and @alanturing881 for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

References

• https://github.com/advisories/GHSA-8634-mr4j-r72c
• https://github.com/wagtail/wagtail/security/advisories/GHSA-8634-mr4j-r72c
• https://nvd.nist.gov/vuln/detail/CVE-2026-54262
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-615.yaml

Related advisories

• GHSA-jm5p-837g-rv8g — medium · PyPI/wagtail
• GHSA-x5cx-w6p2-mxf2 — medium · PyPI/wagtail
• GHSA-c2xx-cjmh-9q8f — medium · PyPI/wagtail
• CVE-2026-55468 — medium · PyPI/wagtail
• CVE-2026-54261 — medium · PyPI/wagtail
• CVE-2026-54259 — medium · PyPI/wagtail
• CVE-2026-54263 — high · PyPI/wagtail
• CVE-2026-54260 — medium · PyPI/wagtail

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity