wagtail
A Django content management system focused on flexibility and user experience
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 304
- Cadence
- ~daily
- Last 12 months
- 32
Reach
- Stars
- 20.6k
Details
- License
- BSD-3-Clause
- First release
- Feb 07, 2014
| Version | Released | |
|---|---|---|
8.1rc1
pre
|
8.1rc1
pre
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
8.0.1
patch
|
8.0.1
patch
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
7.4.4
patch
| ||
7.0.10
patch
| ||
8.0
major
|
8.0
major
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
8.0rc2
pre
|
8.0rc2
pre
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
7.4.3
patch
| ||
7.3.4
patch
| ||
7.0.9
patch
| ||
8.0rc1
pre
5 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev |
8.0rc1
pre
Dependencies (50)
+ 42 more
Changelog
Compare changes
|
|
7.4.2
patch
5 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.3.3
patch
5 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.8
patch
5 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.4.1
patch
10 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54263
GHSA-23m2-mghx-vqmf
PYSEC-2026-616
Aug 20, 2026
Wagtail: Reflected XSS in dynamic image URL generator view
7.3
/ 10
High
Network
Low
Low
Required
Unchanged
High
High
None
ImpactA reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.3.3 and 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to Thibaud Colas (@thibaudcolas) for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
7.3
7.3.1
7.3.2
7.4
7.4.1
Fixed in
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.4
minor
10 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54263
GHSA-23m2-mghx-vqmf
PYSEC-2026-616
Aug 20, 2026
Wagtail: Reflected XSS in dynamic image URL generator view
7.3
/ 10
High
Network
Low
Low
Required
Unchanged
High
High
None
ImpactA reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.3.3 and 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to Thibaud Colas (@thibaudcolas) for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
7.3
7.3.1
7.3.2
7.4
7.4.1
Fixed in
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.3.2
patch
10 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54263
GHSA-23m2-mghx-vqmf
PYSEC-2026-616
Aug 20, 2026
Wagtail: Reflected XSS in dynamic image URL generator view
7.3
/ 10
High
Network
Low
Low
Required
Unchanged
High
High
None
ImpactA reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.3.3 and 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to Thibaud Colas (@thibaudcolas) for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
7.3
7.3.1
7.3.2
7.4
7.4.1
Fixed in
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.7
patch
9 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.4rc1
pre
1 CVE
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev | ||
7.3.1
patch
15 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54263
GHSA-23m2-mghx-vqmf
PYSEC-2026-616
Aug 20, 2026
Wagtail: Reflected XSS in dynamic image URL generator view
7.3
/ 10
High
Network
Low
Low
Required
Unchanged
High
High
None
ImpactA reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.3.3 and 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to Thibaud Colas (@thibaudcolas) for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
7.3
7.3.1
7.3.2
7.4
7.4.1
Fixed in
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev | ||
7.2.3
patch
14 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev | ||
7.0.6
patch
14 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev | ||
6.3.8
patch
14 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev | ||
7.0.5
patch
16 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.3.7
patch
16 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.3
minor
15 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54263
GHSA-23m2-mghx-vqmf
PYSEC-2026-616
Aug 20, 2026
Wagtail: Reflected XSS in dynamic image URL generator view
7.3
/ 10
High
Network
Low
Low
Required
Unchanged
High
High
None
ImpactA reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.3.3 and 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to Thibaud Colas (@thibaudcolas) for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
7.3
7.3.1
7.3.2
7.4
7.4.1
Fixed in
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev | ||
7.2.2
patch
16 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.1.3
patch
16 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.0.4
patch
16 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.3.6
patch
16 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.3rc1
pre
15 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev | ||
7.2.1
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.2
minor
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.2rc1
pre
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.1.2
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.1.1
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.0.3
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.1
minor
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.1rc1
pre
2 CVEs
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
7.0.2
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.2.4
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.0.1
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.4.2
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.3.5
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.0
major
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
7.0rc1
pre
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.3.4
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.4.1
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.4
minor
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
6.3.3
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
5.2.8
patch
17 CVEs
CVE-2026-55468
PYSEC-2026-3939
GHSA-3vrh-m9w7-v94f
Sep 10, 2026
Wagtail: Improper restriction handling on Pages admin API
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners unable to upgrade can apply the fix by overriding the relevant method on AcknowledgementsMany thanks to xuliang@QAX for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Sep 10, 2026 · Source: OSV.dev
GHSA-jm5p-837g-rv8g
Aug 20, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 283 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.1rc1
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
7.4rc1
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References
Updated Oct 26, 2026 · Source: OSV.dev
GHSA-x5cx-w6p2-mxf2
Aug 20, 2026
Wagtail: Improper permission handling when copying snippets
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactA CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsN/A AcknowledgementsMany thanks to tinyb0y for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-c2xx-cjmh-9q8f
Aug 20, 2026
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactThe Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs. AcknowledgementsMany thanks to Ta Duc Thien for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
GHSA-92hv-j533-69wc
Aug 20, 2026
Wagtail: Identification of documents by SHA1 hash
3.7
/ 10
Low
Network
High
None
None
Unchanged
Low
None
None
ImpactBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. PatchesPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. WorkaroundsSite owners who are unable to upgrade can strip AcknowledgementsMany thanks to Anand Himanshu for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 281 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3.3
7.3rc1
7.4
7.4.1
7.4.2
8.0rc1
Fixed in
7.0.9
7.3.4
7.4.3
8.0rc2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54262
GHSA-8634-mr4j-r72c
PYSEC-2026-615
Aug 20, 2026
Wagtail: Pages translations can be created without page permissions when using simple_translation
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @devansh3008 and @alanturing881 for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54261
GHSA-r6p4-grq7-xm4m
PYSEC-2026-614
Aug 20, 2026
Wagtail: Improper permission handling in image preview
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
ImpactDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac and @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613
Aug 20, 2026
Wagtail: Denial of service via unbounded filter specs in the image preview
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
Low
ImpactAn authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to AcknowledgementsMany thanks to @0x1saac for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54259
GHSA-h54r-xq46-qwqm
PYSEC-2026-612
Aug 20, 2026
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactThe Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. WorkaroundsN/A AcknowledgementsMany thanks to @harshakshit for reporting this issue. For more informationIf you have any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 277 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3.2
7.3rc1
7.4
7.4.1
Fixed in
7.0.8
7.3.3
7.4.2
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-25517
PYSEC-2026-2030
GHSA-4qvv-g3vr-m348
Jul 07, 2026
Wagtail has improper permission handling on admin preview endpoints
Medium
Network
Low
High
None
ImpactDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. PatchesPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix. WorkaroundsNo workaround is available. AcknowledgementsMany thanks to @thxtech for reporting this issue. For more informationIf there are any questions or comments about this advisory:
Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 263 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0rc1
7.1
7.1.1
7.1.2
7.1rc1
7.2
7.2.1
7.2rc1
7.3rc1
Fixed in
6.3.6
7.0.4
7.1.3
7.2.2
7.3
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2026-44201
PYSEC-2026-150
GHSA-p5gm-92h4-6pv6
May 11, 2026
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44200
PYSEC-2026-149
GHSA-67rv-mg8q-5pf3
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44199
PYSEC-2026-148
GHSA-pwm3-7fv4-g6xx
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44198
PYSEC-2026-147
GHSA-c4mr-889m-vgf6
May 11, 2026
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-44197
PYSEC-2026-146
GHSA-c6wj-9vcj-75pj
May 11, 2026
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
High
None
None
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 273 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3.8
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
6.4rc1
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2.3
7.2rc1
7.3
7.3.1
7.3rc1
Fixed in
7.0.7
7.3.2
Updated May 20, 2026 · Source: OSV.dev
CVE-2026-28223
PYSEC-2026-2308
GHSA-p4v8-rw59-93cq
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-28222
PYSEC-2026-2307
GHSA-p5cm-246w-84jm
Mar 05, 2026
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1. Affected versions
0.1
0.2
0.3
0.3.1
0.4
0.4.1
0.5
0.6
0.7
0.8
0.8.1
0.8.10
+ 266 more Show less
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
1.0
1.0b1
1.0b2
1.0rc1
1.0rc2
1.1
1.10
1.10.1
1.10rc1
1.11
1.11.1
1.11rc1
1.12
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12rc1
1.13
1.13.1
1.13.2
1.13.3
1.13.4
1.13rc1
1.1rc1
1.2
1.2rc1
1.3
1.3.1
1.3rc1
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4rc1
1.5
1.5.1
1.5.2
1.5.3
1.5rc1
1.6
1.6.1
1.6.2
1.6.3
1.6rc1
1.7
1.7rc1
1.8
1.8.1
1.8.2
1.8rc1
1.9
1.9.1
1.9rc1
2.0
2.0.1
2.0.2
2.0b1
2.0rc1
2.1
2.1.1
2.1.2
2.1.3
2.10
2.10.1
2.10.2
2.10rc1
2.10rc2
2.11
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.11.6
2.11.7
2.11.8
2.11.9
2.11rc1
2.12
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12rc1
2.13
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13rc1
2.13rc2
2.13rc3
2.14
2.14.1
2.14.2
2.14rc1
2.15
2.15.1
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15rc1
2.15rc2
2.16
2.16.1
2.16.2
2.16.3
2.16rc1
2.16rc2
2.1rc1
2.1rc2
2.2
2.2.1
2.2.2
2.2rc1
2.2rc2
2.3
2.3rc1
2.3rc2
2.4
2.4rc1
2.5
2.5.1
2.5.2
2.5rc1
2.6
2.6.1
2.6.2
2.6.3
2.6rc1
2.7
2.7.1
2.7.2
2.7.3
2.7.4
2.7rc1
2.7rc2
2.8
2.8.1
2.8.2
2.8rc1
2.9
2.9.1
2.9.2
2.9.3
2.9rc1
3.0
3.0.1
3.0.2
3.0.3
3.0rc1
3.0rc2
3.0rc3
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0rc1
4.0rc2
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1rc1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2rc1
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0rc1
5.1
5.1.1
5.1.2
5.1.3
5.1rc1
5.2
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2rc1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0rc1
6.1
6.1.1
6.1.2
6.1.3
6.1rc1
6.1rc2
6.2
6.2.1
6.2.2
6.2.3
6.2.4
6.2rc1
6.3
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7
6.3rc1
6.3rc2
6.4
6.4.1
6.4.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0rc1
7.1
7.1.1
7.1.2
7.1.3
7.2
7.2.1
7.2.2
7.2rc1
Fixed in
6.3.8
7.0.6
7.2.3
References
Updated Jul 13, 2026 · Source: OSV.dev |