Vulnerability-Lookup

CVE-2026-55468 (GCVE-0-2026-55468)

Vulnerability from cvelistv5 – Published: 2026-08-24 20:37 – Updated: 2026-08-25 16:32

Title

Wagtail: Improper restriction handling on Pages admin API

Summary

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 16:32 UTC

CWE

CWE-280 - Improper Handling of Insufficient Permissions or Privileges

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7648 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/wagtail/wagtail/security/advis…	x_refsource_CONFIRM
https://github.com/wagtail/wagtail/commit/5608cfb…	x_refsource_MISC
https://github.com/wagtail/wagtail/commit/aef9355…	x_refsource_MISC
https://github.com/wagtail/wagtail/commit/d99d2be…	x_refsource_MISC
https://github.com/wagtail/wagtail/commit/e2fa629…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
wagtail	wagtail	Affected: < 7.0.9 Affected: >= 7.1, < 7.3.4 Affected: >= 7.4, < 7.4.3 Affected: >= 8.0rc1, < 8.0rc2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55468",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:32:30.966622Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T16:32:43.104Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wagtail",
          "vendor": "wagtail",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.0.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.1, \u003c 7.3.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.4, \u003c 7.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0rc1, \u003c 8.0rc2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-280",
              "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-24T20:37:36.460Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f"
        },
        {
          "name": "https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975"
        },
        {
          "name": "https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4"
        },
        {
          "name": "https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559"
        },
        {
          "name": "https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3"
        }
      ],
      "source": {
        "advisory": "GHSA-3vrh-m9w7-v94f",
        "discovery": "UNKNOWN"
      },
      "title": "Wagtail: Improper restriction handling on Pages admin API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55468",
    "datePublished": "2026-08-24T20:37:36.460Z",
    "dateReserved": "2026-06-16T22:10:37.608Z",
    "dateUpdated": "2026-08-25T16:32:43.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55468",
      "date": "2026-10-14",
      "epss": "0.00342",
      "percentile": "0.26045"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "wagtail",
                "vendor": "wagtail",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 7.0.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.1, \u003c 7.3.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.4, \u003c 7.4.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.0rc1, \u003c 8.0rc2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."
          },
          {
            "lang": "es",
            "value": "Wagtail es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto construido sobre Django. Antes de las versiones 7.0.9, 7.3.4, 7.4.3 y 8.0rc2 en sus respectivas l\u00edneas de lanzamiento, la API de administraci\u00f3n interna de P\u00e1ginas devuelve campos de p\u00e1gina declarados en api_fields sin suficiente control de acceso, permitiendo a un usuario con acceso de administrador de Wagtail recuperar contenido restringido de p\u00e1ginas en borrador y en vivo. Este problema se corrige en las versiones 7.0.9, 7.3.4, 7.4.3 y 8.0rc2."
          }
        ],
        "id": "CVE-2026-55468",
        "lastModified": "2026-10-12T21:10:00.227",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55468",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:32:30.966622Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-24T21:17:41.290",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-280"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55468",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-25T16:32:30.966622Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-25T16:32:37.935Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "wagtail",
              "vendor": "wagtail",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 7.0.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.1, \u003c 7.3.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.4, \u003c 7.4.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.0rc1, \u003c 8.0rc2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-280",
                  "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-24T20:37:36.460Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f"
            },
            {
              "name": "https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975"
            },
            {
              "name": "https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4"
            },
            {
              "name": "https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559"
            },
            {
              "name": "https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3"
            }
          ],
          "source": {
            "advisory": "GHSA-3vrh-m9w7-v94f",
            "discovery": "UNKNOWN"
          },
          "title": "Wagtail: Improper restriction handling on Pages admin API"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55468",
        "datePublished": "2026-08-24T20:37:36.460Z",
        "dateReserved": "2026-06-16T22:10:37.608Z",
        "dateUpdated": "2026-08-25T16:32:43.104Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55468

Vulnerability from fkie_nvd - Published: 2026-08-24 21:17 - Updated: 2026-10-12 21:10

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975
	security-advisories@github.com	https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4
	security-advisories@github.com	https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559
	security-advisories@github.com	https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3
	security-advisories@github.com	https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "wagtail",
          "vendor": "wagtail",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.0.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.1, \u003c 7.3.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.4, \u003c 7.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0rc1, \u003c 8.0rc2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."
    },
    {
      "lang": "es",
      "value": "Wagtail es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto construido sobre Django. Antes de las versiones 7.0.9, 7.3.4, 7.4.3 y 8.0rc2 en sus respectivas l\u00edneas de lanzamiento, la API de administraci\u00f3n interna de P\u00e1ginas devuelve campos de p\u00e1gina declarados en api_fields sin suficiente control de acceso, permitiendo a un usuario con acceso de administrador de Wagtail recuperar contenido restringido de p\u00e1ginas en borrador y en vivo. Este problema se corrige en las versiones 7.0.9, 7.3.4, 7.4.3 y 8.0rc2."
    }
  ],
  "id": "CVE-2026-55468",
  "lastModified": "2026-10-12T21:10:00.227",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55468",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T16:32:30.966622Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-24T21:17:41.290",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-280"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3VRH-M9W7-V94F

Vulnerability from github – Published: 2026-08-20 18:42 – Updated: 2026-08-20 18:42

Summary

Wagtail: Improper restriction handling on Pages admin API

Details

Impact

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

# wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy


def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Acknowledgements

Many thanks to xuliang@QAX for reporting this issue.

For more information

If you have any questions or comments about this advisory:

Visit Wagtail's support channels
Email us at security@wagtail.org (view our security policy for more information).

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1"
            },
            {
              "fixed": "7.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.4"
            },
            {
              "fixed": "7.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0rc1"
            },
            {
              "fixed": "8.0rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.0rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55468"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-280"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:42:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe internal Pages admin [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly returns page fields  without access control when they are declared in `api_fields`. A user with access to the Wagtail admin can use this API to fetch draft and live page fields\u2019 contents that are part of `api_fields` on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in `api_fields`.\n\nThe vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\n\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\n\nSite owners unable to upgrade can apply the fix by overriding the relevant method on `PagesAdminAPIViewSet` to patch all vulnerable admin API endpoints:\n\n```python\n# wagtail_hooks.py or AppConfig.ready()\n\nfrom wagtail.admin.api.views import PagesAdminAPIViewSet\nfrom wagtail.permissions import page_permission_policy\n\n\ndef _restricted_get_base_queryset(self):\n    return page_permission_policy.explorable_instances(self.request.user)\n\nPagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset\n```\n\n### Acknowledgements\n\nMany thanks to xuliang@QAX for reporting this issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n-   Visit Wagtail\u0027s [support channels](https://docs.wagtail.org/en/stable/support.html)\n-   Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).",
  "id": "GHSA-3vrh-m9w7-v94f",
  "modified": "2026-08-20T18:42:25Z",
  "published": "2026-08-20T18:42:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wagtail/wagtail"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Wagtail: Improper restriction handling on Pages admin API"
}

PYSEC-2026-3939

Vulnerability from pysec - Published: 2026-09-10 09:44 - Updated: 2026-09-10 11:02

Details

Impact

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

# wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy


def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Acknowledgements

Many thanks to xuliang@QAX for reporting this issue.

For more information

If you have any questions or comments about this advisory:

Visit Wagtail's support channels
Email us at security@wagtail.org (view our security policy for more information).

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Impacted products

Name	purl
wagtail	pkg:pypi/wagtail

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail",
        "purl": "pkg:pypi/wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.9"
            },
            {
              "introduced": "7.1"
            },
            {
              "fixed": "7.3.4"
            },
            {
              "introduced": "7.4"
            },
            {
              "fixed": "7.4.3"
            },
            {
              "introduced": "8.0rc1"
            },
            {
              "fixed": "8.0rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.0rc1",
        "0.1",
        "0.2",
        "0.3",
        "0.3.1",
        "0.4",
        "0.4.1",
        "0.5",
        "0.6",
        "0.7",
        "0.8",
        "0.8.1",
        "0.8.10",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.8.5",
        "0.8.6",
        "0.8.7",
        "0.8.8",
        "0.8.9",
        "1.0",
        "1.0b1",
        "1.0b2",
        "1.0rc1",
        "1.0rc2",
        "1.1",
        "1.10",
        "1.10.1",
        "1.10rc1",
        "1.11",
        "1.11.1",
        "1.11rc1",
        "1.12",
        "1.12.1",
        "1.12.2",
        "1.12.3",
        "1.12.4",
        "1.12.5",
        "1.12.6",
        "1.12rc1",
        "1.13",
        "1.13.1",
        "1.13.2",
        "1.13.3",
        "1.13.4",
        "1.13rc1",
        "1.1rc1",
        "1.2",
        "1.2rc1",
        "1.3",
        "1.3.1",
        "1.3rc1",
        "1.4",
        "1.4.1",
        "1.4.2",
        "1.4.3",
        "1.4.4",
        "1.4.5",
        "1.4.6",
        "1.4rc1",
        "1.5",
        "1.5.1",
        "1.5.2",
        "1.5.3",
        "1.5rc1",
        "1.6",
        "1.6.1",
        "1.6.2",
        "1.6.3",
        "1.6rc1",
        "1.7",
        "1.7rc1",
        "1.8",
        "1.8.1",
        "1.8.2",
        "1.8rc1",
        "1.9",
        "1.9.1",
        "1.9rc1",
        "2.0",
        "2.0.1",
        "2.0.2",
        "2.0b1",
        "2.0rc1",
        "2.1",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.10",
        "2.10.1",
        "2.10.2",
        "2.10rc1",
        "2.10rc2",
        "2.11",
        "2.11.1",
        "2.11.2",
        "2.11.3",
        "2.11.4",
        "2.11.5",
        "2.11.6",
        "2.11.7",
        "2.11.8",
        "2.11.9",
        "2.11rc1",
        "2.12",
        "2.12.1",
        "2.12.2",
        "2.12.3",
        "2.12.4",
        "2.12.5",
        "2.12.6",
        "2.12rc1",
        "2.13",
        "2.13.1",
        "2.13.2",
        "2.13.3",
        "2.13.4",
        "2.13.5",
        "2.13rc1",
        "2.13rc2",
        "2.13rc3",
        "2.14",
        "2.14.1",
        "2.14.2",
        "2.14rc1",
        "2.15",
        "2.15.1",
        "2.15.2",
        "2.15.3",
        "2.15.4",
        "2.15.5",
        "2.15.6",
        "2.15rc1",
        "2.15rc2",
        "2.16",
        "2.16.1",
        "2.16.2",
        "2.16.3",
        "2.16rc1",
        "2.16rc2",
        "2.1rc1",
        "2.1rc2",
        "2.2",
        "2.2.1",
        "2.2.2",
        "2.2rc1",
        "2.2rc2",
        "2.3",
        "2.3rc1",
        "2.3rc2",
        "2.4",
        "2.4rc1",
        "2.5",
        "2.5.1",
        "2.5.2",
        "2.5rc1",
        "2.6",
        "2.6.1",
        "2.6.2",
        "2.6.3",
        "2.6rc1",
        "2.7",
        "2.7.1",
        "2.7.2",
        "2.7.3",
        "2.7.4",
        "2.7rc1",
        "2.7rc2",
        "2.8",
        "2.8.1",
        "2.8.2",
        "2.8rc1",
        "2.9",
        "2.9.1",
        "2.9.2",
        "2.9.3",
        "2.9rc1",
        "3.0",
        "3.0.1",
        "3.0.2",
        "3.0.3",
        "3.0rc1",
        "3.0rc2",
        "3.0rc3",
        "4.0",
        "4.0.1",
        "4.0.2",
        "4.0.3",
        "4.0.4",
        "4.0rc1",
        "4.0rc2",
        "4.1",
        "4.1.1",
        "4.1.2",
        "4.1.3",
        "4.1.4",
        "4.1.5",
        "4.1.6",
        "4.1.7",
        "4.1.8",
        "4.1.9",
        "4.1rc1",
        "4.2",
        "4.2.1",
        "4.2.2",
        "4.2.3",
        "4.2.4",
        "4.2rc1",
        "5.0",
        "5.0.1",
        "5.0.2",
        "5.0.3",
        "5.0.4",
        "5.0.5",
        "5.0rc1",
        "5.1",
        "5.1.1",
        "5.1.2",
        "5.1.3",
        "5.1rc1",
        "5.2",
        "5.2.1",
        "5.2.2",
        "5.2.3",
        "5.2.4",
        "5.2.5",
        "5.2.6",
        "5.2.7",
        "5.2.8",
        "5.2rc1",
        "6.0",
        "6.0.1",
        "6.0.2",
        "6.0.3",
        "6.0.4",
        "6.0.5",
        "6.0.6",
        "6.0rc1",
        "6.1",
        "6.1.1",
        "6.1.2",
        "6.1.3",
        "6.1rc1",
        "6.1rc2",
        "6.2",
        "6.2.1",
        "6.2.2",
        "6.2.3",
        "6.2.4",
        "6.2rc1",
        "6.3",
        "6.3.1",
        "6.3.2",
        "6.3.3",
        "6.3.4",
        "6.3.5",
        "6.3.6",
        "6.3.7",
        "6.3.8",
        "6.3rc1",
        "6.3rc2",
        "6.4",
        "6.4.1",
        "6.4.2",
        "6.4rc1",
        "7.0",
        "7.0.1",
        "7.0.2",
        "7.0.3",
        "7.0.4",
        "7.0.5",
        "7.0.6",
        "7.0.7",
        "7.0.8",
        "7.0rc1",
        "7.1",
        "7.1.1",
        "7.1.2",
        "7.1.3",
        "7.2",
        "7.2.1",
        "7.2.2",
        "7.2.3",
        "7.2rc1",
        "7.3",
        "7.3.1",
        "7.3.2",
        "7.3.3",
        "7.3rc1",
        "7.4",
        "7.4.1",
        "7.4.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55468",
    "GHSA-3vrh-m9w7-v94f"
  ],
  "details": "### Impact\n\nThe internal Pages admin [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly returns page fields  without access control when they are declared in `api_fields`. A user with access to the Wagtail admin can use this API to fetch draft and live page fields\u2019 contents that are part of `api_fields` on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in `api_fields`.\n\nThe vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\n\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\n\nSite owners unable to upgrade can apply the fix by overriding the relevant method on `PagesAdminAPIViewSet` to patch all vulnerable admin API endpoints:\n\n```python\n# wagtail_hooks.py or AppConfig.ready()\n\nfrom wagtail.admin.api.views import PagesAdminAPIViewSet\nfrom wagtail.permissions import page_permission_policy\n\n\ndef _restricted_get_base_queryset(self):\n    return page_permission_policy.explorable_instances(self.request.user)\n\nPagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset\n```\n\n### Acknowledgements\n\nMany thanks to xuliang@QAX for reporting this issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n-   Visit Wagtail\u0027s [support channels](https://docs.wagtail.org/en/stable/support.html)\n-   Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).",
  "id": "PYSEC-2026-3939",
  "modified": "2026-09-10T11:02:36.337796Z",
  "published": "2026-09-10T09:44:52.570171Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wagtail/wagtail"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/wagtail"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-3vrh-m9w7-v94f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55468"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Wagtail: Improper restriction handling on Pages admin API"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55468 (GCVE-0-2026-55468)

FKIE_CVE-2026-55468

GHSA-3VRH-M9W7-V94F

Impact

Patches

Workarounds

Acknowledgements

For more information

PYSEC-2026-3939

Impact

Patches

Workarounds

Acknowledgements

For more information

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour