Improper Handling of Insufficient Permissions or Privileges in wagtail - #VU156668
Published: October 21, 2026
Vulnerability identifier: #VU156668
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-280
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access draft page data that would otherwise be unavailable to them.
The vulnerability exists due to improper handling of insufficient permissions in Wagtail's API v3 (preview) pages endpoint when processing requests for draft page revisions. A remote user can submit requests using an API bearer token to retrieve otherwise inaccessible draft revisions of pages that are either a direct parent of a page they have permission to edit or common ancestors of multiple pages they have permission to edit.
Affected software
wagtail
Remediation
Install security update from vendor's website.
wagtail - update to 8.0.1