CVE-2026-44198
Received Received - Intake
Information Disclosure in Wagtail CMS

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: GitHub, Inc.

Description
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-06-21
AI Q&A
2026-05-11
EPSS Evaluated
2026-06-19
NVD
CVE-2026-44198
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
wagtail wagtail to 7.0.7 (exc)
wagtail wagtail to 7.3.1 (exc)
wagtail wagtail 7.3.2
wagtail wagtail 7.4
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-280 The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-44198 is a vulnerability in the Wagtail content management system that affects versions prior to 7.0.7, 7.1-7.3.1. It involves improper permission handling which allows a CMS user who does not have permission to edit a page to still access the page's history report.

This unauthorized access to the page history can potentially lead to the disclosure of sensitive information contained in the history report.

The vulnerability is classified under CWE-280, which relates to improper handling of insufficient permissions, and has been fixed in versions 7.0.7, 7.3.2, and 7.4 of Wagtail.

Impact Analysis

This vulnerability can impact you by allowing users without proper edit permissions to view the history report of pages in the Wagtail CMS.

As a result, sensitive information that is stored or revealed in the page history could be disclosed to unauthorized users.

The impact is limited to confidentiality, with no impact on integrity or availability, and the vulnerability has a moderate severity score (CVSS 4.3).

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Mitigation Strategies

The vulnerability is fixed in Wagtail versions 7.0.7, 7.3.2, and 7.4. Immediate mitigation involves upgrading your Wagtail installation to one of these patched versions.

No workaround is available, so applying the official patch is the recommended action.

Compliance Impact

This vulnerability allows users without edit permissions to access the history report of a page, potentially leading to the disclosure of sensitive information.

Such unauthorized disclosure of sensitive information could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

By exposing sensitive information to unauthorized users, the vulnerability increases the risk of non-compliance with these regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart