A Wagtail CMS user who can add snippets but cannot view or change an existing snippet may still invoke the copy view and duplicate that snippet. The copy operation bypasses normal permission checks and reveals the snippet’s content to the user. This is an instance of improper access control (CWE‑280) that leads to unauthorized data disclosure.

The flaw affects Wagtail content management systems running any version earlier than 7.0.9, 7.3.4, 7.4.3, or 8.0rc2. Users of those affected releases should identify their exact build and plan to upgrade.

The CVSS score of 6.5 indicates medium severity, mainly due to the confidentiality impact. No EPSS data is available, and the issue is not listed in CISA KEV, suggesting no widely known exploits yet. The likely attack vector is internal: an authenticated user with add permission for the snippet model, lacking view or change rights, can trigger the vulnerability through the standard Wagtail admin interface. No remote code execution or privilege escalation is implied by the current description.