{"uuid": "3c4956a6-6932-4f6b-a0f2-eba2f94693e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-92HV-J533-69WC", "type": "seen", "source": "https://gist.github.com/alon710/7842c3c142867ceb50ac8440e801b01e", "content": "# GHSA-92HV-J533-69WC: GHSA-92HV-J533-69WC: Information Disclosure via ETag Conditional Matching in Wagtail CMS\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-92HV-J533-69WC\n\n## Summary\nAn information disclosure vulnerability in the document serving subsystem of Wagtail CMS allows unauthorized users to verify if private documents match guessed SHA-1 hashes due to improper order of authentication checks.\n\n## TL;DR\nWagtail CMS evaluates HTTP ETag headers before enforcing authentication and authorization checks on document serve views, leaking whether specific documents match guessed SHA-1 hashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-280\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.7 (Low)\n- **Vulnerability Type**: Information Disclosure\n- **Exploit Status**: Proof of Concept\n- **Component**: wagtail/documents/views/serve.py\n\n## Affected Systems\n\n- Wagtail CMS\n- **Wagtail**: < 7.0.9 (Fixed in: `7.0.9`)\n- **Wagtail**: >= 7.1, < 7.3.4 (Fixed in: `7.3.4`)\n- **Wagtail**: >= 7.4, < 7.4.3 (Fixed in: `7.4.3`)\n- **Wagtail**: == 8.0rc1 (Fixed in: `8.0rc2`)\n\n## Mitigation\n\n- Upgrade Wagtail to a patched version (7.0.9, 7.3.4, 7.4.3, or 8.0rc2 depending on active branch).\n- Strip 'If-Match' and 'If-None-Match' headers from incoming requests to the /documents/ path at the reverse proxy or WAF layer.\n\n**Remediation Steps:**\n1. Identify current Wagtail version deployed in the target environment.\n2. Update the dependencies file (e.g. requirements.txt) to specify the secure version of Wagtail.\n3. Run pip install -r requirements.txt to apply the upgrade in target environments.\n4. Deploy the updated application and verify that conditional GET requests to private documents by unauthorized clients no longer return HTTP 304 status codes.\n\n## References\n\n- [GitHub Security Advisory GHSA-92HV-J533-69WC](https://github.com/advisories/GHSA-92HV-J533-69WC)\n- [Wagtail Project Security Advisory](https://github.com/wagtail/wagtail/security/advisories/GHSA-92hv-j533-69wc)\n- [Wagtail CMS Main Source Code Repository](https://github.com/wagtail/wagtail)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-92HV-J533-69WC) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T08:35:12.907296Z"}