CVE-2026-54262: Wagtail Translation Permission Bypass Vulnerability

Technical summary

CVE-2026-54262 is an authorization flaw (CWE-280) in Wagtail's translation workflow. The vulnerability stems from insufficient permission checks when processing translation submission requests. A user account with the narrow "Can submit translation" permission can craft requests to create translations for pages outside their authorized scope. The flaw affects Wagtail versions prior to 7.0.8, 7.3.3, and 7.4.2. The CVSS 3.1 score of 4.3 (MEDIUM) reflects low attack complexity, network accessibility, and limited confidentiality impact—the attacker gains visibility into content they shouldn't access but cannot modify the original page or trigger availability issues.

Business impact

This vulnerability creates content governance and compliance risks. Unauthorized translation creation could introduce inaccurate or malicious content into regulated pages without audit trails, potentially affecting multi-language publishing integrity. For organizations managing sensitive or compliance-heavy content (healthcare, finance, legal), unauthorized access to page translation workflows may violate data protection or content approval policies. The blast radius depends on how translation permissions are scoped in your deployment—if translator accounts exist across many content areas, the risk surface is wider.

Affected systems

Wagtail instances running versions prior to 7.0.8 (6.x line), 7.3.3 (7.3.x line), or 7.4.2 (7.4.x line) are affected. Self-hosted and managed deployments are equally at risk. The vulnerability only impacts instances where translation features are enabled and where users hold the "Can submit translation" permission.

Exploitability

The attack requires valid user credentials with the "Can submit translation" permission—no authentication bypass or CSRF component is involved. The exploit is straightforward: an authenticated user calls the translation submission endpoint for a page they lack modify permissions on. No special tools, timing, or user interaction are required. However, the attacker must first obtain a translator-level account, which typically implies some level of insider access or account compromise. This moderates the practical risk for externally exposed instances, though internal threats remain significant.

Remediation

Update Wagtail to version 7.0.8, 7.3.3, or 7.4.2 or later. The patch introduces proper permission validation in the translation submission handler, ensuring only users with explicit modify permissions on a page can create translations for it. Verify your current version against your Wagtail installation before patching; check your requirements file or run `pip show wagtail`.

Patch guidance

Apply the appropriate patch version for your current Wagtail release line: upgrade 6.x deployments to 7.0.8 or later, 7.3.x to 7.3.3 or later, or 7.4.x to 7.4.2 or later. Coordinate patching with any custom translation workflow extensions you may have deployed, as the permission logic changes could interact with customizations. Test translation functionality in a staging environment before production deployment to ensure no operational disruption.

Detection guidance

Monitor your Wagtail audit logs for translation submissions on pages where the submitting user does not hold modify permissions. Check the user_actions table for "CREATE_TRANSLATION" events paired with page IDs the user cannot normally edit. Review translator group membership against content hierarchies to identify overly permissive role assignments. If you suspect unauthorized translation activity, query your database for translations created by low-permission accounts on sensitive pages and compare creation timestamps against user access patterns.

Why prioritize this

Although CVSS rates this as MEDIUM (4.3), prioritize patching based on your content governance model. Organizations with strict editorial controls, compliance requirements, or multi-language publishing of sensitive content should treat this as elevated priority. If your translator accounts are isolated to non-critical content areas or if you have strong supplementary approval workflows, the practical risk is lower. However, the ease of exploitation for any user holding translator permissions warrants timely patching across all environments.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a low network-accessible attack requiring valid credentials (PR:L), low attack complexity, and confidentiality impact limited to unauthorized page visibility (C:L). No integrity or availability impact occurs. The score does not account for downstream business risk from content manipulation or compliance violations, so security teams should layer organizational context on top of the base metric.

Frequently asked questions