CVE-2026-54262: Wagtail CMS Auth Bypass Vulnerability

CVE-2026-54262 Overview

CVE-2026-54262 is an improper authorization vulnerability in Wagtail, an open source content management system built on Django. A low-privileged user granted the Can submit translation permission can create translations for any page, including pages they have no other permissions to modify. The flaw affects Wagtail versions prior to 7.0.8, 7.3.3, and 7.4.2. Maintainers addressed the issue in versions 7.0.8, 7.3.3, and 7.4.2.

Critical Impact
Authenticated users with the translation submission permission can bypass page-level authorization to create translations for content they are not otherwise permitted to modify [CWE-280].

Affected Products

Wagtail versions prior to 7.0.8
Wagtail versions prior to 7.3.3
Wagtail versions prior to 7.4.2

Discovery Timeline

2026-07-01 - CVE-2026-54262 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-54262

Vulnerability Analysis

The vulnerability is an authorization bypass in Wagtail's translation submission workflow. Wagtail exposes a Can submit translation permission that allows editors to initiate translations of existing pages. The affected versions do not verify whether the requesting user also holds edit or publish permissions on the target page tree. As a result, any authenticated user with only the translation permission can create translation objects for pages outside their assigned scope.

This flaw maps to [CWE-280: Improper Handling of Insufficient Permissions or Privileges]. The impact is limited to integrity of the translation workflow and does not require user interaction. Exploitation requires an authenticated account with the specific permission granted, which limits practical exposure but expands the effective privilege of any compromised or malicious translator account.

Root Cause

The root cause is a missing page-level authorization check in the translation submission code path. The permission model treats Can submit translation as globally sufficient rather than scoping the action to pages the user can already access. Consequently, the view accepts submissions against arbitrary page identifiers.

Attack Vector

An attacker authenticated to a Wagtail instance with the Can submit translation permission issues a translation submission request targeting a page outside their normal editing scope. The server processes the request without validating page-level permissions, creating translation entries for restricted pages. See the GitHub Security Advisory for technical details on the affected code paths.

Detection Methods for CVE-2026-54262

Indicators of Compromise

Translation objects created for pages outside the submitting user's assigned editor groups or page trees.
Audit log entries showing translation submissions by users who lack edit permissions on the associated source page.
Sudden appearance of translation drafts on high-value or restricted pages after a low-privilege account is granted the Can submit translation permission.

Detection Strategies

Review Wagtail audit logs and Django application logs for translation submission events, correlating the acting user's group membership against the source page's permission scope.
Query the database for translation records and compare the created_by user against the page owner and permission groups on the parent page.
Baseline expected translator activity and alert on submissions targeting page trees the account has never previously edited.

Monitoring Recommendations

Forward Wagtail and Django logs to a centralized logging or SIEM platform and retain translation submission events for review.
Monitor administrative changes to Wagtail group permissions, particularly assignment of the Can submit translation permission.
Track HTTP requests to translation submission endpoints and alert on high-volume or off-hours activity from non-administrative accounts.

How to Mitigate CVE-2026-54262

Immediate Actions Required

Upgrade Wagtail to 7.0.8, 7.3.3, or 7.4.2 depending on the deployed release line.
Audit existing user accounts holding the Can submit translation permission and revoke it from users who do not require translation workflow access.
Review recent translation submissions for unauthorized activity against restricted page trees.

Patch Information

The Wagtail maintainers fixed the vulnerability in versions 7.0.8, 7.3.3, and 7.4.2. Details of the fix are available in the Wagtail GitHub Security Advisory GHSA-8634-mr4j-r72c.

Workarounds

Remove the Can submit translation permission from all groups until the upgrade is applied.
Restrict access to the Wagtail admin interface to trusted networks using reverse proxy or firewall rules.
Increase monitoring of translation-related database tables and admin actions while the patch is being rolled out.

bash

# Upgrade Wagtail to a patched release using pip
pip install --upgrade "wagtail>=7.4.2"
# Or, for the 7.3.x line:
pip install --upgrade "wagtail>=7.3.3,<7.4"
# Or, for the 7.0.x line:
pip install --upgrade "wagtail>=7.0.8,<7.1"