Description

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-24T21:17:41.290Z",
  "pubdate": "2026-08-24T21:17:41.290Z",
  "executiveSummary": "An access control vulnerability exists within the internal Pages admin API of Wagtail, an open-source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the application fails to enforce sufficient access controls when returning page fields declared in api_fields. This flaw enables a low-privileged user possessing basic Wagtail admin access to improperly retrieve restricted draft and live page content that should otherwise be withheld based on their permission level. The risk implication involves unauthorized disclosure of sensitive or confidential editorial content across the content management system. Exploitation of this vulnerability requires authenticated access to the Wagtail administrative interface, allowing an attacker with constrained administrative privileges to harvest restricted information by querying the internal API endpoints directly.",
  "technicalDetails": "The vulnerability resides in the internal Pages admin API component of Wagtail, specifically within the handling and serialization of page fields defined via the api_fields attribute. The root cause of the issue stems from a failure in the authorization logic to properly validate whether the requesting user possesses the necessary granular permissions to view specific draft and live page content associated with those fields. When a user with basic Wagtail admin access interacts with the administrative interface, the internal API processes requests to retrieve page data without adequately enforcing restriction checks on the underlying content models. To exploit this vulnerability, an authenticated attacker with standard administrative privileges initiates targeted HTTP requests directly to the internal Pages admin API endpoints. Upon receiving the request, the vulnerable component fails to restrict the output of sensitive attributes declared in api_fields, returning restricted draft and live page contents in the API response payload. The affected software versions comprise Wagtail prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines. The attack vector is network-based, necessitating active authentication within the administrative boundary, but requires minimal privilege requirements beyond baseline Wagtail admin access. The post-exploitation impact is characterized by the unauthorized exposure of confidential draft materials, unreleased structured content, and restricted live page data, undermining the principle of least privilege and content segregation within the content management system."
}