CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Scoring

Severity

MEDIUM

CVSS base score

4.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS probability

0.20%

CWE

CWE-280

Published

2026-08-24

Last modified

2026-08-25

Affected products

• wagtail wagtail
• wagtail wagtail
• wagtail wagtail
• wagtail wagtail

Weakness type

• CWE-280

Related vulnerabilities

• CVE-2026-69907 — Windows Enterprise App Management Elevation of Privilege Vulnerability
• CVE-2026-59567 — Local privilege escalation
• CVE-2026-58416 — Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
• CVE-2026-73239 — Apache Allura: Missing permission checks IDOR
• CVE-2026-18860 — Velociraptor incorrect Org deletion permissions check
• CVE-2026-11804 — Program Module Vulnerability
• CVE-2026-62393 — Apache Kylin: Improper authorization in job information retrieval
• CVE-2026-45196 — GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel

Markdown version · Browse all CVEs