What is the CVSS score of CVE-2026-44198?

CVE-2026-44198 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44198?

Yes, a patch is available for CVE-2026-44198. Update the affected software to the latest version immediately.

CVE-2026-44198

MEDIUM

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-05-08 https://github.com/wagtail/wagtail

GHSA-c4mr-889m-vgf6

Information Disclosure

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

May 08, 2026 - 20:19 nvd

MEDIUM 4.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on wagtail (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 7.1.

DescriptionGitHub Advisory

Impact

A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks Seoyoung Kang @seoyoung-kang who is from AhnLab and also an independent security researcher for reporting this issue.

For more information

If there are any questions or comments about this advisory:

Visit Wagtail's support channels
Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the security policy for more information).

Analysis

Impact

A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.