CVE-2026-44199: Wagtail has improper permission handling when deleting form submissions

A CMS user with limited access to form pages could delete submissions to form pages they don’t have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don’t.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.