THREAT OPS › Threat News › [GHSA] GHSA-8634-mr4j-r72c (medium) — Wagtail: Pages translations can be created without page permissions when using simple_translation
[GHSA] GHSA-8634-mr4j-r72c (medium) — Wagtail: Pages translations can be created without page permissions when using simple_translation
GHSA-8634-mr4j-r72c Severity: medium CVE: CVE-2026-54262
Wagtail: Pages translations can be created without page permissions when using simple_translation
### Impact A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for.
### Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
Indicators of compromise
- CVE-2026-54262cve
- https://docs.wagtail.org/en/stable/support.htmlurl
- security@wagtail.orgemail
Original source: https://github.com/advisories/GHSA-8634-mr4j-r72c