What is the CVSS score of CVE-2026-54261?

CVE-2026-54261 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-54261?

Yes, a patch is available for CVE-2026-54261. Update the affected software to the latest version immediately.

Wagtail CMS CVE-2026-54261

EUVD-2026-41148 MEDIUM

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-07-01 GitHub_M

GHSA-r6p4-grq7-xm4m PYSEC-2026-614

Python Information Disclosure Wagtail

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

Only visual image previews are exposed (not object data or metadata), warranting C:L over C:H; PR:L reflects mandatory admin authentication as a prerequisite.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 23:02 EUVD

Analysis Generated

Jul 01, 2026 - 22:25 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on wagtail (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 7.1.

DescriptionCVE.org

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

AnalysisAI

Missing authorization on the image preview endpoint in Wagtail CMS allows any authenticated admin-panel user to render previews of images they do not have permission to access. Affected across three maintained release branches - all Wagtail versions prior to 7.0.8, 7.3.3, and 7.4.2. No public exploit has been identified at time of analysis, and exploitation is strictly bounded to users holding valid Wagtail admin credentials, making this a privileged-insider or compromised-account risk rather than an external threat.

Technical ContextAI

Wagtail is a widely adopted open-source CMS built on the Django framework (Python), identified by CPE cpe:2.3:a:wagtail:wagtail:*:*:*:*:*:*:*:*. The root cause is CWE-280 (Improper Handling of Insufficient Permissions or Privileges): the image preview endpoint processes and renders image content in response to authenticated admin requests without verifying whether the requesting user holds the appropriate per-image or per-collection access rights. Wagtail implements granular image permissions through collections, allowing administrators to restrict which users can view specific image sets - this authorization layer is bypassed entirely at the preview endpoint. The vulnerability is specific to the preview rendering path; the underlying image object record and its metadata are not exposed through this flaw.

RemediationAI

Upgrade Wagtail to version 7.0.8, 7.3.3, or 7.4.2 depending on which release branch is in use; these releases introduce the missing permission check on the image preview endpoint and represent the only complete fix. The vendor advisory is published at https://github.com/wagtail/wagtail/security/advisories/GHSA-r6p4-grq7-xm4m. For deployments unable to patch immediately, the most effective compensating control is restricting Wagtail admin access to the minimum set of trusted users - this does not eliminate the flaw but reduces the population of potential exploiting principals. Alternatively, network-layer controls (WAF rules or reverse-proxy ACLs) targeting the image preview endpoint could restrict its accessibility, though this would break legitimate preview functionality for all admin users and is not recommended as a long-term mitigation. No other documented workarounds exist.