CVE-2026-123820
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Description
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though descendants inherit ancestor view restrictions. An API user can therefore list the filenames and names of documents and images stored in descendant collections that should remain private. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
INFO
Published Date :
Nov. 9, 2026, 9:24 p.m.
Last Modified :
Nov. 9, 2026, 9:24 p.m.
Remotely Exploit :
Yes !
Source :
GitHub_M
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Update Wagtail to version 7.0.9 or later.
- Update Wagtail to version 7.3.4 or later.
- Update Wagtail to version 7.4.3 or later.
- Update Wagtail to version 8.0rc2 or later.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-123820 vulnerability anywhere in the article.