GHSA-jm5p-837g-rv8g: Wagtail: Improper restriction handling on Page translation API endpoint

August 20, 2026

A CMS user with the “submit translations” permission, could use the Admin API’s “copy for translation” endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.

References

github.com/advisories/GHSA-jm5p-837g-rv8g
github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g

Code Behaviors & Features

Detect and mitigate GHSA-jm5p-837g-rv8g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →