CVE-2026-123819
6.5 MEDIUMpublic exploit availablePublished 2026-11-09 · Updated 2026-11-09
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-280
Public exploit & PoC references
- https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4
- https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be
- https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c
- https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10
- https://github.com/wagtail/wagtail/releases/tag/v7.0.9
- https://github.com/wagtail/wagtail/releases/tag/v7.3.4
- https://github.com/wagtail/wagtail/releases/tag/v7.4.3
- https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
- https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2
All references
- https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4
- https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be
- https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c
- https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10
- https://github.com/wagtail/wagtail/releases/tag/v7.0.9
- https://github.com/wagtail/wagtail/releases/tag/v7.3.4
- https://github.com/wagtail/wagtail/releases/tag/v7.4.3
- https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
- https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-123820PoC
- LOWCVE-2026-125105PoC
- MEDIUMCVE-2026-125106PoC
- MEDIUMCVE-2026-20577
- MEDIUMCVE-2026-20599
- UNSCOREDCVE-2026-21121
- UNSCOREDCVE-2026-3322PoC
- LOWCVE-2026-54471
Related by shared AI tags and CWE weakness class. Browse the full archive.