CVE-2026-44197
Received Received - Intake
Information Disclosure in Wagtail CMS

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: GitHub, Inc.

Description
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-06-21
AI Q&A
2026-05-11
EPSS Evaluated
2026-06-19
NVD
CVE-2026-44197
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
wagtail wagtail to 7.0.7 (exc)
wagtail wagtail From 7.1 (inc) to 7.3.2 (exc)
wagtail wagtail 7.3.2
wagtail wagtail 7.4
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-280 The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

This vulnerability allows unauthorized CMS users to access page revisions containing potentially sensitive information, leading to a disclosure of confidential data.

Such unauthorized disclosure of sensitive information can negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.

Because the flaw involves improper permission handling and unauthorized access, organizations using affected versions of Wagtail may face increased risk of non-compliance with these regulations until the vulnerability is patched.

Executive Summary

This vulnerability affects the Wagtail content management system. It allows a user who does not have permission to edit a page to access revisions of that page through the revision compare view if they know the primary keys of two revisions.

The root cause is improper permission handling, which means unauthorized users can view sensitive information in page revisions even though they lack the necessary privileges.

This issue was fixed in Wagtail versions 7.0.7, 7.3.2, and 7.4.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information contained in page revisions.

Since users without edit permissions can access revision data, confidential or private content might be exposed to unauthorized individuals.

The CVSS score of 6.5 indicates a moderate severity with a high impact on confidentiality, meaning the main risk is information leakage.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Wagtail to one of the fixed versions: 7.0.7, 7.3.2, or 7.4.

No workarounds are available, so applying the official patch is the only effective mitigation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart