FKIE_CVE-2026-55468

Vulnerability from fkie_nvd - Published: 2026-08-24 21:17 - Updated: 2026-10-12 21:10
Severity
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
References
security-advisories@github.comhttps://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975
security-advisories@github.comhttps://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4
security-advisories@github.comhttps://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559
security-advisories@github.comhttps://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3
security-advisories@github.comhttps://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "wagtail",
          "vendor": "wagtail",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.0.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.1, \u003c 7.3.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.4, \u003c 7.4.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0rc1, \u003c 8.0rc2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."
    },
    {
      "lang": "es",
      "value": "Wagtail es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto construido sobre Django. Antes de las versiones 7.0.9, 7.3.4, 7.4.3 y 8.0rc2 en sus respectivas l\u00edneas de lanzamiento, la API de administraci\u00f3n interna de P\u00e1ginas devuelve campos de p\u00e1gina declarados en api_fields sin suficiente control de acceso, permitiendo a un usuario con acceso de administrador de Wagtail recuperar contenido restringido de p\u00e1ginas en borrador y en vivo. Este problema se corrige en las versiones 7.0.9, 7.3.4, 7.4.3 y 8.0rc2."
    }
  ],
  "id": "CVE-2026-55468",
  "lastModified": "2026-10-12T21:10:00.227",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55468",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T16:32:30.966622Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-24T21:17:41.290",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-280"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.