CVE-2026-44201

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:torchbox:wagtail::::::::
	cpe:2.3:a:torchbox:wagtail::::::::

History

No history.

Information

Published : 2026-05-11 16:17

Updated : 2026-06-17 10:50

NVD link : CVE-2026-44201

Mitre link : CVE-2026-44201

CVE.ORG link : CVE-2026-44201

JSON object : View

Products Affected

torchbox

wagtail

CWE

CWE-280

Improper Handling of Insufficient Permissions or Privileges

{"id": "CVE-2026-44201", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44201", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:45:22.754566Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"status": "affected", "version": "< 7.0.7"}, {"status": "affected", "version": ">= 7.1, < 7.3.2"}]}]}], "published": "2026-05-11T16:17:35.850", "references": [{"url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-280"}]}], "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4."}], "lastModified": "2026-06-17T10:50:21.060", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA54A323-7F77-4D1D-9830-BF8FBE4B5B34", "versionEndExcluding": "7.0.7"}, {"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FED1A6D7-1193-485D-B25F-60FCC20A6D6B", "versionEndExcluding": "7.3.2", "versionStartIncluding": "7.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}