CVE-2026-55468

Received Received - Intake

Information Disclosure in Wagtail CMS

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: GitHub, Inc.

Description

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-55468

Affected Vendors & Products

Vendor	Product	Version / Range
wagtail	wagtail	to 7.0.9 (inc)
wagtail	wagtail	to 7.3.4 (inc)
wagtail	wagtail	to 7.4.3 (inc)
wagtail	wagtail	to 8.0rc2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-280	The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

Executive Summary

This vulnerability affects Wagtail, a Django-based content management system. It allows users with admin access to retrieve restricted draft and live page content through the internal Pages admin API. The issue occurs because the API returns page fields without proper access control.

Impact Analysis

If you use Wagtail with admin access, an attacker with admin privileges could access sensitive content marked as restricted. This could lead to unauthorized data exposure, including draft content not yet published.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by exposing sensitive data to unauthorized users. Unauthorized access to restricted content may result in data breaches, leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade Wagtail to versions 7.0.9, 7.3.4, 7.4.3, or 8.0rc2 or later to fix the access control issue in the Pages admin API.

Hi! I’m here to help you understand CVE-2026-55468. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70