CVE-2026-54261

Received Received - Intake

Unauthorized Image Preview Access in Wagtail CMS

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: GitHub, Inc.

Description

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-01

Generated

2026-07-02

AI Q&A

2026-07-02

EPSS Evaluated

N/A

NVD

CVE-2026-54261

Affected Vendors & Products

Vendor	Product	Version / Range
wagtail	wagtail	to 7.0.8 (exc)
wagtail	wagtail	to 7.3.3 (exc)
wagtail	wagtail	to 7.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-280	The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

Impact Analysis

The impact of this vulnerability is that a user with Wagtail admin access can preview any image without proper permission checks. This could lead to unauthorized viewing of images within the system, potentially exposing sensitive or private images to users who should not have access to them. However, since the actual image data is not exposed and ordinary site visitors cannot exploit this, the impact is limited to users with admin privileges.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Wagtail to one of the fixed versions: 7.0.8, 7.3.3, or 7.4.2.

Additionally, ensure that only trusted users have access to the Wagtail admin interface, as the vulnerability requires admin access to be exploitable.

Executive Summary

This vulnerability exists in Wagtail, an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3, and 7.4.2, there is a missing permission check on the image preview endpoint. This means that a user who has access to the Wagtail admin interface can preview any image, even those they might not normally have permission to view. However, the actual data of the image object is not exposed through this vulnerability. Ordinary site visitors without admin access cannot exploit this issue.

Hi! I’m here to help you understand CVE-2026-54261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70