Em resumo
- CVE-2026-54262 é uma vulnerabilidade MÉDIO (CVSS 4.3) que afeta wagtail, wagtail (torchbox).
- Chance de exploração nos próximos 30 dias (EPSS): 0.27%, maior que 19.3% das vulnerabilidades.
- Correção: atualize para 7.3.3, 7.4.2, 7.0.8 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| wagtail PyPI | ≥ 7.1, < 7.3.3≥ 7.4, < 7.4.2< 7.0.8
| 7.3.37.4.27.0.8
|
| wagtail | ≥ 7.1, < 7.3.3≥ 7.4, < 7.4.2< 7.0.8
| 7.3.37.4.27.0.8
|
Description
Impact
A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for.
Patches
Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
Workarounds
N/A
Acknowledgements
Many thanks to @devansh3008 and @alanturing881 for reporting this issue.
For more information
If you have any questions or comments about this advisory:
NVD description
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free