Wagtail CMS CVE-2026-54261

Exploitation requires a valid Wagtail admin account - the vulnerability is explicitly not reachable by ordinary site visitors without admin-panel access. The attacker must be able to authenticate to the Wagtail admin interface and send HTTP requests to the image preview endpoint with valid or enumerated image IDs. The flaw is present in default Wagtail installations wherever multiple admin users exist with differentiated image collection permissions; no special non-default configuration is required to be vulnerable. Exploitation is bounded by what the image preview endpoint exposes: only the visual rendered image is accessible, not the image object's stored metadata or database record. The limiting factors are the mandatory admin authentication barrier (PR:L in CVSS) and the constrained output (preview rendering only, not full data exfiltration).

The NVD CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5, but C:H likely overstates the impact since only the visual image preview is accessible - not the full image object or associated metadata. Real-world risk is substantially modulated by the PR:L constraint: this vulnerability is entirely unexploitable by unauthenticated visitors and requires an attacker to already hold Wagtail admin credentials. The most realistic threat actor is a low-privileged internal admin user seeking to view images restricted to higher-privileged roles, or an attacker who has already compromised a low-privileged admin account and is escalating information access. No EPSS data was provided in the source intelligence; no CISA KEV listing is present; no POC or exploit code is referenced. SSVC signals: exploitation status is none/proof-of-concept unknown, the vulnerability is not autonomously exploitable by internet scanners (requires auth), and technical impact is partial confidentiality only. This is a real but low-urgency finding whose priority rises significantly in multi-tenant or media-sensitive Wagtail deployments where image collection permissions are a meaningful access control boundary.

An authenticated Wagtail admin user with access limited to a specific image collection sends direct HTTP requests to the image preview endpoint using image IDs belonging to restricted collections. By enumerating sequential or guessed image IDs, the attacker renders previews of images they are not authorized to view - for example, confidential product images, internal HR photos, or unpublished media assets stored in restricted collections. No public exploit code is known at time of analysis, and the attack requires prior admin authentication.