CVE-2026-44197
Received Received - Intake
Information Disclosure in Wagtail CMS

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: GitHub, Inc.

Description
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-05-11
AI Q&A
2026-05-11
EPSS Evaluated
N/A
NVD
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
wagtail wagtail to 7.0.7 (exc)
wagtail wagtail From 7.1 (inc) to 7.3.2 (exc)
wagtail wagtail 7.3.2
wagtail wagtail 7.4
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-280 The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects the Wagtail content management system. It allows a user who does not have permission to edit a page to access revisions of that page through the revision compare view if they know the primary keys of two revisions.

The root cause is improper permission handling, which means unauthorized users can view sensitive information in page revisions even though they lack the necessary privileges.

This issue was fixed in Wagtail versions 7.0.7, 7.3.2, and 7.4.


How can this vulnerability impact me? :

The vulnerability can lead to unauthorized disclosure of sensitive information contained in page revisions.

Since users without edit permissions can access revision data, confidential or private content might be exposed to unauthorized individuals.

The CVSS score of 6.5 indicates a moderate severity with a high impact on confidentiality, meaning the main risk is information leakage.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, you should upgrade Wagtail to one of the fixed versions: 7.0.7, 7.3.2, or 7.4.

No workarounds are available, so applying the official patch is the only effective mitigation.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart