https://vulnerability.circl.lu/sightings/feed 2026-09-26T15:49:39.257539+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/06c7feba-eab6-42f3-b76a-9ee90dac0ef5/export 2026-09-26T15:49:39.284517+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "06c7feba-eab6-42f3-b76a-9ee90dac0ef5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88421", "type": "seen", "source": "https://gist.github.com/itsmohitnarayan/736225bd6cd79031a5dfbf56acdb14ae", "content": "# CVE-2026-88421: Restricted Puput entries disclosed to unauthenticated users\n\n## CVE ID\nCVE-2026-88421\n\n## Affected Product\n- Project: APSL/Puput\n- Repository: https://github.com/APSL/puput\n- Package: https://pypi.org/project/puput/\n- Affected component: `puput/models.py` (`BlogPage.get_entries`)\n\n## Affected Versions\nPuput 0.1 through 2.2.0. The vulnerable queryset is present from the initial release through the current `master` branch at commit `ce7a2f5`. Version 2.2.0 is the latest release.\n\n## Patched Versions\nNone as of 2026-09-22.\n\n## Vulnerability / Problem Type\nCWE-862: Missing Authorization\n\n## Summary\n`BlogPage.get_entries()` filters entries with `.live()` but does not apply Wagtail's `.public()` filter. As a result, entries protected by password, login-required, or group-based `PageViewRestriction` rules are still returned to anonymous listing views.\n\nThe affected queryset supplies the blog index, tag, category, author and date archives, sidebar widgets, and RSS feed. These surfaces disclose a restricted entry's title, author, publication date, canonical URL, and either its configured excerpt or the first 70 words of its body. Direct access to the entry itself remains protected, which confirms that the disclosure is caused by the listing queryset bypassing the restriction.\n\n## Impact\nAn unauthenticated attacker can enumerate protected entries and read their excerpts or partial bodies through public listing pages and RSS. The RSS feed makes the disclosed information easy to retrieve and archive in bulk even though direct requests to the protected entry show Wagtail's access-control page.\n\n## Proof of Concept\n1. Create and publish a Puput entry with a distinctive title and sensitive excerpt.\n2. Add a Wagtail password `PageViewRestriction` to that entry.\n3. Request the entry directly as an anonymous user. Wagtail returns its password form.\n4. Request the blog index and RSS feed anonymously:\n\n```bash\ncurl -s http://127.0.0.1:8000/blog/ | grep 'SECRET quarterly numbers'\ncurl -s http://127.0.0.1:8000/blog/feed/ | grep 'SECRET quarterly numbers'\n```\n\nObserved on Puput 2.2.0: both public responses contain the restricted entry. The blog index also renders its excerpt, or a 70-word truncation of `body` when no excerpt is set.\n\nThe issue was reproduced with Django 4.2.30 and Wagtail 6.2.4, then re-verified with Wagtail 6.4.2.\n\n## Root Cause\n`BlogPage.get_entries()` uses `EntryPage.objects.descendant_of(self).live()` but omits `.public()`. In Wagtail, `.live()` excludes unpublished pages; it does not enforce `PageViewRestriction`. The `.public()` queryset filter excludes view-restricted pages.\n\n## Remediation\nAdd `.public()` to the queryset used by `BlogPage.get_entries()`. This safe default hides restricted entries from all public listings. A permission-aware listing for users who already satisfied a restriction would require passing request-specific restriction state into the listing logic.\n\n## References\n- Vulnerable queryset: https://github.com/APSL/puput/blob/ce7a2f5293c4778f144e16ba9cd5e8ce1c348f27/puput/models.py#L32-L33\n- Excerpt/body disclosure: https://github.com/APSL/puput/blob/ce7a2f5293c4778f144e16ba9cd5e8ce1c348f27/puput/templates/puput/blog_page.html#L66-L70\n- Puput 2.2.0 release: https://github.com/APSL/puput/releases/tag/2.2.0\n\n## Disclosure Timeline\n- 2026-08-26: Vulnerability identified and reproduced against Puput 2.2.0.\n- 2026-08-27: CVE ID requested from MITRE.\n- 2026-09-22: MITRE assigned CVE-2026-88421.\n\n## Reporter\nKumar Mohit ([@itsmohitnarayan](https://github.com/itsmohitnarayan)).\n", "creation_timestamp": "2026-09-22T12:43:45.105810Z"} 2026-09-22T12:43:45.105810+00:00