GHSA-3VRH-M9W7-V94F

Vulnerability from github – Published: 2026-08-20 18:42 – Updated: 2026-08-20 18:42
VLAI
Summary
Wagtail: Improper restriction handling on Pages admin API
Details

Impact

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

# wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy


def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Acknowledgements

Many thanks to xuliang@QAX for reporting this issue.

For more information

If you have any questions or comments about this advisory:

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1"
            },
            {
              "fixed": "7.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.4"
            },
            {
              "fixed": "7.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0rc1"
            },
            {
              "fixed": "8.0rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.0rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55468"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-280"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:42:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe internal Pages admin [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly returns page fields  without access control when they are declared in `api_fields`. A user with access to the Wagtail admin can use this API to fetch draft and live page fields\u2019 contents that are part of `api_fields` on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in `api_fields`.\n\nThe vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\n\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\n\nSite owners unable to upgrade can apply the fix by overriding the relevant method on `PagesAdminAPIViewSet` to patch all vulnerable admin API endpoints:\n\n```python\n# wagtail_hooks.py or AppConfig.ready()\n\nfrom wagtail.admin.api.views import PagesAdminAPIViewSet\nfrom wagtail.permissions import page_permission_policy\n\n\ndef _restricted_get_base_queryset(self):\n    return page_permission_policy.explorable_instances(self.request.user)\n\nPagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset\n```\n\n### Acknowledgements\n\nMany thanks to xuliang@QAX for reporting this issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n-   Visit Wagtail\u0027s [support channels](https://docs.wagtail.org/en/stable/support.html)\n-   Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).",
  "id": "GHSA-3vrh-m9w7-v94f",
  "modified": "2026-08-20T18:42:25Z",
  "published": "2026-08-20T18:42:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wagtail/wagtail"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Wagtail: Improper restriction handling on Pages admin API"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.