CVE-2026-123819

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

• CWE-280

• https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4
• https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be
• https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c
• https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10
• https://github.com/wagtail/wagtail/releases/tag/v7.0.9
• https://github.com/wagtail/wagtail/releases/tag/v7.3.4
• https://github.com/wagtail/wagtail/releases/tag/v7.4.3
• https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
• https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2

Published

Nov 9, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123813pyLoad is a free and open-source download manager written in…7.5
• CVE-2026-123814pyLoad is a free and open-source download manager written in…6.4
• CVE-2026-123815pyLoad is a free and open-source download manager written in…9.4
• CVE-2026-123816pyLoad is a free and open-source download manager written in…8.1
• CVE-2026-123817AIOHTTP is an asynchronous HTTP client/server framework for …8.7
• CVE-2026-123818LMDeploy is a toolkit for compressing, deploying, and servin…7.5
• CVE-2026-12382A flaw was found in the AAP Gateway Envoy proxy configuratio…8.2
• CVE-2026-123820Wagtail is an open source content management system built on…5.3
• CVE-2026-123824The Symfony Config component XmlUtils::parse() enables DTD v…6.3
• CVE-2026-123828A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc ha…5.9
• CVE-2026-123829A Permission Model bypass in Node.js recursive file watching…2.5
• CVE-2026-12383A flaw was found in the Event-Driven Ansible (EDA) server. T…7.5