CVE-2026-125106

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-280

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 9, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1251077.5Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::Crea CVE-2026-1251083.7Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading e CVE-2026-1251094.8Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return a CVE-2026-125118.1The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing CVE-2026-1251105.3Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info norm CVE-2026-1251117.5Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its inter CVE-2026-1251135.3The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across mu CVE-2026-1251156.8Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/u CVE-2026-1251164.8Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mo CVE-2026-1251178.2Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mo CVE-2026-1251186.5Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Sc CVE-2026-1251197.5Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.