CVE-2026-44197
Information Disclosure in Wagtail CMS
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wagtail | wagtail | to 7.0.7 (exc) |
| wagtail | wagtail | From 7.1 (inc) to 7.3.2 (exc) |
| wagtail | wagtail | 7.3.2 |
| wagtail | wagtail | 7.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-280 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Wagtail content management system. It allows a user who does not have permission to edit a page to access revisions of that page through the revision compare view if they know the primary keys of two revisions.
The root cause is improper permission handling, which means unauthorized users can view sensitive information in page revisions even though they lack the necessary privileges.
This issue was fixed in Wagtail versions 7.0.7, 7.3.2, and 7.4.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information contained in page revisions.
Since users without edit permissions can access revision data, confidential or private content might be exposed to unauthorized individuals.
The CVSS score of 6.5 indicates a moderate severity with a high impact on confidentiality, meaning the main risk is information leakage.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Wagtail to one of the fixed versions: 7.0.7, 7.3.2, or 7.4.
No workarounds are available, so applying the official patch is the only effective mitigation.