Wagtail allows a user with limited page access to copy an unrelated page, bypassing source‑page permission checks. Once copied, the user can view and publish the content. The flaw is a classic permission mis‑management issue (CWE‑280). It enables unauthorized disclosure of content and accidental publication of restricted material.

The vulnerability affects Wagtail CMS versions older than 7.0.7, 7.3.2, and 7.4. Users running any of these releases are at risk if they permit page copy actions to users who do not normally see those pages.

The CVSS score of 6.5 indicates a moderate severity. Exploitation requires a valid user account with the ability to use the copy function; no remote code execution or elevated privileges outside the CMS are necessary. EPSS data is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is through the web interface, where an authenticated user performs a page copy action that the system fails to constrain based on the source page’s permissions.