CVE-2026-44200

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44200", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T15:13:47.570Z", "datePublished": "2026-05-11T14:41:41.807Z", "dateUpdated": "2026-05-11T19:07:11.475Z"}, "containers": {"cna": {"title": "Wagtail: Improper permission handling when copying pages", "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "lang": "en", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3"}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"version": "< 7.0.7", "status": "affected"}, {"version": ">= 7.1, < 7.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T14:41:41.807Z"}, "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4."}], "source": {"advisory": "GHSA-67rv-mg8q-5pf3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T18:54:04.086666Z", "id": "CVE-2026-44200", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T19:07:11.475Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44200", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T15:13:47.570Z", "datePublished": "2026-05-11T14:41:41.807Z", "dateUpdated": "2026-05-11T19:07:11.475Z"}, "containers": {"cna": {"title": "Wagtail: Improper permission handling when copying pages", "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "lang": "en", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3"}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"version": "< 7.0.7", "status": "affected"}, {"version": ">= 7.1, < 7.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T14:41:41.807Z"}, "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4."}], "source": {"advisory": "GHSA-67rv-mg8q-5pf3", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44200", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:54:04.086666Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:54:18.966Z"}}]}}

{"affected": [{"affectedData": [{"product": "wagtail", "vendor": "wagtail", "versions": [{"status": "affected", "version": "< 7.0.7"}, {"status": "affected", "version": ">= 7.1, < 7.3.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA54A323-7F77-4D1D-9830-BF8FBE4B5B34", "versionEndExcluding": "7.0.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "FED1A6D7-1193-485D-B25F-60FCC20A6D6B", "versionEndExcluding": "7.3.2", "versionStartIncluding": "7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4."}, {"lang": "es", "value": "Wagtail es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto construido sobre Django. Antes de 7.0.7, 7.3.2 y 7.4, un usuario del CMS con acceso limitado a p\u00e1ginas pod\u00eda copiar una p\u00e1gina a la que no ten\u00eda acceso a un \u00e1rea del sitio a la que s\u00ed lo ten\u00eda. Una vez copiada, pod\u00eda ver su contenido y, potencialmente, publicarla. Los permisos se verificaban correctamente para el destino de la copia, pero no para la p\u00e1gina de origen. Esta vulnerabilidad est\u00e1 corregida en 7.0.7, 7.3.2 y 7.4."}], "id": "CVE-2026-44200", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44200", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T18:54:04.086666Z", "version": "2.0.3"}}]}, "published": "2026-05-11T16:17:35.713", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-280"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1,7.3.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wagtail", "source": "cna", "vendor": "wagtail"}, "product": "wagtail", "vendor": "wagtail"}], "created": "2026-05-11T17:00:15.777661+00:00", "updated": "2026-05-11T17:15:39.756738+00:00", "vendors": ["wagtail", "wagtail$PRODUCT$wagtail"]}