CVE-2026-55468Medium· 4.3▾ SunlitWagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without suf…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Last analysed / modified upstream
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wagtail < 7.0.9wagtail >= 7.1, < 7.3.4wagtail >= 7.4, < 7.4.3wagtail >= 8.0rc1, < 8.0rc2Patched in:
wagtail 7.0.9wagtail 7.3.4wagtail 7.4.3wagtail 8.0rc2Connected by shared product, vendor, weakness, or advisory.
CVE-2021-29434Medium· 6.1Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
GHSA-jm5p-837g-rv8gMedium· 6.5Wagtail: Improper restriction handling on Page translation API endpoint
CVE-2023-28836Medium· 6.4Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
CVE-2023-28837Medium· 4.4Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
CVE-2020-15118Medium· 5.7Cross-Site Scripting in Wagtail
CVE-2026-28222Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes