SB2026102187 - Multiple vulnerabilities in wagtail

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102187

SB2026102187 - Multiple vulnerabilities in wagtail

Published: October 21, 2026

Security Bulletin ID SB2026102187
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's browser through stored cross-site scripting, potentially disclosing sensitive information or modifying content accessible to the victim.

The vulnerability exists due to improper sanitization in Wagtail's rich text handling when processing content submitted through the v3 write API or third-party editors using the legacy "Editor HTML" conversion logic. A remote user can submit specially crafted rich text with edit permission over pages or snippets to store malicious HTML and execute scripts when a victim views the affected content.


2) Improper Handling of Insufficient Permissions or Privileges (CVE-ID: N/A)

CWE-ID: CWE-280 - Improper Handling of Insufficient Permissions or Privileges

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access page contents that would otherwise be unavailable to them.

The vulnerability exists due to improper handling of insufficient permissions in Wagtail's internal Pages admin API when processing requests for ancestor pages. A remote user can request the contents of a direct parent of a page they can edit, or a common ancestor of multiple pages they can edit, to disclose otherwise restricted page contents.


3) Improper Handling of Insufficient Permissions or Privileges (CVE-ID: N/A)

CWE-ID: CWE-280 - Improper Handling of Insufficient Permissions or Privileges

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access draft page data that would otherwise be unavailable to them.

The vulnerability exists due to improper handling of insufficient permissions in Wagtail's API v3 (preview) pages endpoint when processing requests for draft page revisions. A remote user can submit requests using an API bearer token to retrieve otherwise inaccessible draft revisions of pages that are either a direct parent of a page they have permission to edit or common ancestors of multiple pages they have permission to edit.


4) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: N/A)

CWE-ID: CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information through injected spreadsheet formulas.

The vulnerability exists due to improper neutralization of formula elements in Wagtail's XLSX export functionality when exporting untrusted user input from forms, reports, or other sources. A remote attacker can supply a crafted string that is exported as a formula and interpreted when a victim opens the file in an external spreadsheet application to potentially disclose sensitive information.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass collection access restrictions and potentially disclose sensitive documents.

The vulnerability exists due to incorrect authorization in Wagtail's collection privacy settings when handling privacy-setting changes. A remote user can use administrative interface access and the "change" permission for at least one collection to modify privacy settings for another collection outside their permitted scope, potentially removing access restrictions and exposing sensitive documents.


Remediation

Install update from vendor's website.

References