A flaw in Wagtail’s Admin API allows a user who has the submit translations permission to trigger the"Copy for translation" action on a page that the user is not allowed to edit. The action creates a translation of the protected page, effectively exposing its contents to the requester. The vulnerability enables privilege escalation within the CMS and can result in confidentiality breaches of sensitive content without requiring any additional credentials. The weakness is classified as CWE‑280.

The issue affects Wagtail CMS versions released before 7.0.9, before 7.3.4, before 7.4.3, and the 8.0rc2 pre‑release. It applies to all installations of the Wagtail product that do not contain the corresponding patch releases. The affected system is the Wagtail CMS web application running on a Django stack.

The CVSS score of 6.5 indicates a moderate severity. EPSS data is not available, so the current probability of exploitation is unknown, but the flaw has been publicly disclosed and a fix has been released. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to authenticate to the CMS and possess the submit translations permission; the attack is typically carried out via the site’s Admin API endpoint and does not require remote code execution.