Wagtail CMS CVE-2026-54262

Exploitation requires: (1) a valid authenticated session in the Wagtail admin with the 'Can submit translation' permission explicitly granted; (2) the Wagtail internationalization/translation feature to be enabled in the deployment (not a default minimal install); (3) knowledge or enumeration of the page ID or slug of the target restricted page. Exploitation is limited by: the need for at least low-privilege account access (PR:L per CVSS vector), the translation feature must be configured and active, and impact is read-only (no canonical content modification or deletion). Unauthenticated external attackers cannot exploit this vulnerability.

The vendor-assigned CVSS 3.1 score of 4.3 (Medium) reflects a realistic, if modest, risk profile: network-exploitable (AV:N), low complexity (AC:L), requires low privilege (PR:L), and results in only low confidentiality impact (C:L) with no integrity or availability impact. EPSS data was not provided, but given the absence of public exploit code, KEV listing, or active exploitation reports, real-world exploitation probability is likely low-to-moderate in the near term. The primary risk is internal threat actors or compromised low-privilege accounts using the translation workflow as a side-channel to read restricted page content without triggering normal access-control audit logs. The impact ceiling is bounded: no write access to canonical page content is achieved, and scope remains unchanged (S:U). Defenders in multi-tenant or regulated environments (e.g., government, media, healthcare) where content confidentiality matters before publication should treat this as a genuine priority; purely public-facing Wagtail deployments with no sensitive unpublished content face lower practical risk.

An authenticated Wagtail editor with the 'Can submit translation' permission - but no view rights on a confidential draft page such as an embargoed press release - navigates to the translation submission endpoint and supplies the ID or slug of the restricted page. The server creates a translation record and surfaces the page content to the user through the translation workflow interface, bypassing the page-tree permission gate. No public exploit code has been identified, but the attack requires only a valid session and knowledge of target page identifiers, which may be enumerable.