Wagtail CMS CVE-2026-44199
MEDIUM
GHSA-pwm3-7fv4-g6xx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Requires authenticated Wagtail admin session (PR:L); no confidentiality or availability impact; deletion of submissions represents high integrity loss.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 pypi packages depend on wagtail (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 7.1.
DescriptionGitHub Advisory
Impact
A CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Wagtail thanks Vishal Shukla @shukla304 for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels
- Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the security policy for more information).
AnalysisAI
Improper permission enforcement in Wagtail's form submission deletion feature allows authenticated CMS users with limited access to delete form submissions belonging to pages outside their authorized scope. Affected versions are pip/wagtail < 7.0.7 and >= 7.1, < 7.3.2. An attacker must already hold a Wagtail admin account - ordinary site visitors cannot exploit this. No public exploit or active exploitation (CISA KEV) has been identified; EPSS stands at 0.03% (8th percentile), consistent with SSVC's 'exploitation: none' assessment.
Technical ContextAI
Wagtail is a Django-based Python CMS (pkg:pip/wagtail). Its form pages expose a submission management interface within the Wagtail admin panel, where CMS editors can review and delete collected form responses. The root cause is CWE-280 (Improper Handling of Insufficient Permissions or Privileges): the server-side deletion handler validates that the requesting user holds access to at least one form page but fails to enforce that the targeted submission IDs belong to a page within the user's permitted scope. This allows a crafted deletion request referencing foreign submission records to succeed, bypassing the intended page-level authorization boundary.
RemediationAI
Upgrade to Wagtail 7.0.7 (for deployments on the 7.0.x branch), 7.3.2 (for deployments on the 7.1.x-7.3.x branch), or the 7.4 LTS release, all of which include the authorization fix. The advisory at https://github.com/wagtail/wagtail/security/advisories/GHSA-pwm3-7fv4-g6xx provides direct guidance. No workaround is available per the vendor; if immediate patching is not possible, organizations should audit and minimize the set of CMS accounts granted any form-page access, and review deletion audit logs for anomalous cross-page activity. Restricting Wagtail admin panel access by IP or VPN reduces exposure but does not eliminate the vulnerability for internal threat scenarios.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today