CVE-2026-123819

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-280

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 9, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-123828.2A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP head CVE-2026-1238205.3Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Ima CVE-2026-1238246.3The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external CVE-2026-1238285.9A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an a CVE-2026-1238292.5A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to re CVE-2026-123837.5A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classe CVE-2026-1238319.6In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings CVE-2026-1238329.6In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database CVE-2026-1238333.6In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects CVE-2026-1238348.1In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account CVE-2026-1238355.9In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition CVE-2026-1238368.8In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup