CVE-2026-44198
Information Disclosure in Wagtail CMS
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wagtail | wagtail | to 7.0.7 (exc) |
| wagtail | wagtail | to 7.3.1 (exc) |
| wagtail | wagtail | 7.3.2 |
| wagtail | wagtail | 7.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-280 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-44198 is a vulnerability in the Wagtail content management system that affects versions prior to 7.0.7, 7.1-7.3.1. It involves improper permission handling which allows a CMS user who does not have permission to edit a page to still access the page's history report.
This unauthorized access to the page history can potentially lead to the disclosure of sensitive information contained in the history report.
The vulnerability is classified under CWE-280, which relates to improper handling of insufficient permissions, and has been fixed in versions 7.0.7, 7.3.2, and 7.4 of Wagtail.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing users without proper edit permissions to view the history report of pages in the Wagtail CMS.
As a result, sensitive information that is stored or revealed in the page history could be disclosed to unauthorized users.
The impact is limited to confidentiality, with no impact on integrity or availability, and the vulnerability has a moderate severity score (CVSS 4.3).
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in Wagtail versions 7.0.7, 7.3.2, and 7.4. Immediate mitigation involves upgrading your Wagtail installation to one of these patched versions.
No workaround is available, so applying the official patch is the recommended action.