CVE-2026-55468

Published: Ago 24, 2026 Last Modified: Ago 24, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

280

Improper Handling of Insufficient Permissions or Privileges

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Other Alter Execution Logic
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/wagtail/wagtail/commit/5608cfb714a130412…
https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79…
https://github.com/wagtail/wagtail/commit/aef935530d5289406…
https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28…
https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d…
https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd…
https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d…
https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c…
https://github.com/wagtail/wagtail/security/advisories/GHSA…
https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f