CVE-2026-54262 MEDIUM

CVE-2026-54262: Wagtail: Pages translations can be created without page permissions when using simple_translation

Vendor Wagtail
Product wagtail
Weakness CWE-280
Published July 1, 2026
Last update July 1, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

Key dates

02Disclosure timeline

July 1, 2026 CVE published