Wagtail CMS CVE-2026-44198
MEDIUM
GHSA-c4mr-889m-vgf6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires authenticated low-privilege CMS account (PR:L); confidentiality-only impact (C:L) as revision data is disclosed but no modification or service disruption occurs.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 pypi packages depend on wagtail (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 7.1.
DescriptionGitHub Advisory
Impact
A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Wagtail thanks Seoyoung Kang @seoyoung-kang who is from AhnLab and also an independent security researcher for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels
- Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the security policy for more information).
AnalysisAI
Improper permission enforcement in Wagtail CMS allows authenticated low-privilege users to access the page history report for pages they lack edit rights on, resulting in potential disclosure of sensitive revision content. Affected versions are pip/wagtail prior to 7.0.7 and 7.1 through below 7.3.2. No public exploit code exists and no active exploitation has been identified; EPSS of 0.03% (7th percentile) and CISA SSVC classification of 'Exploitation: none' confirm this as a low-priority disclosure issue limited to the authenticated CMS user population.
Technical ContextAI
Wagtail is a Django-based open-source CMS distributed via pip (pkg:pip/wagtail). The root cause is CWE-280 (Improper Handling of Insufficient Permissions or Privileges): the page history/audit log endpoint fails to enforce the same edit-level access control that governs page modification. Wagtail's permission model distinguishes between users who can view the CMS and users who can edit specific pages; this flaw reveals that the permission gate protecting page history was implemented inconsistently, allowing the history view to be reached by any authenticated CMS user regardless of their page-level edit rights. The CPE identifier pkg:pip/wagtail covers all affected releases across the 7.0.x and 7.1-7.3.x branches.
RemediationAI
Upgrade Wagtail to version 7.0.7 if on the 7.0.x branch, or to 7.3.2 if on the 7.1-7.3.x branch. Installations should also consider migrating to the 7.4 LTS release, which incorporates this fix and provides long-term support. The vendor advisory is published at https://github.com/wagtail/wagtail/security/advisories/GHSA-c4mr-889m-vgf6. Per the vendor, no workaround is available. As an interim compensating control while patching, administrators should audit and restrict the pool of authenticated CMS users to only those with a legitimate business need for CMS access, reducing the number of accounts capable of exploiting this bypass; however, this does not remediate the underlying flaw and should not substitute for patching.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today