6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44200

CVE-2026-44200: Wagtail: Improper permission handling when copying pages

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44200

CVE-2026-44200:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wagtail	pip	< 7.0.7	7.0.7
wagtail	pip	>= 7.1, < 7.3.2	7.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Wagtail allowed a user with limited permissions to copy a page they did not have access to into a part of the site they controlled, thereby gaining access to its content. The root cause was a failure to check the user's permissions on the source page being copied; checks were only performed for the destination.

The analysis of the security patches reveals several key changes that pinpoint the vulnerable functions:

The wagtail.admin.views.pages.copy.copy view, the entrypoint for the copy action, was modified to explicitly check can_copy() permission on the source page.
The core permission logic in wagtail.models.pages.Page.can_copy() was fundamentally changed. The vulnerable version simply checked if the page was not a root page (return not self.page_is_root), while the patched version requires the user to have edit permissions (return self.can_edit()). This change is the crux of the fix.
The wagtail.models.pages.Page.can_copy_to() method was updated to first call the now-corrected can_copy() method, ensuring the source page permission check is always performed.
The wagtail.admin.forms.pages.CopyForm.clean() method, which handles validation, was updated to use the corrected can_copy_to permission check, replacing a weaker check.
A similar vulnerability in page alias creation was fixed in wagtail.actions.create_alias.CreatePageAliasAction.check() by adding the same can_copy_to permission check.

During exploitation, a runtime profiler would show calls to wagtail.admin.views.pages.copy.copy, which in turn invokes the other vulnerable methods on the CopyForm and Page models. The identified functions are those that were modified to add the missing, critical permission checks on the source page.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.