Medium severity · published May 11, 2026
CVE-2026-44201
Wagtail: Improper restriction handling on Documents and Images API
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wagtail · wagtail
< 7.0.7; >= 7.1, < 7.3.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44201
Vendor Advisory
https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6
More from wagtail
7.3
CVE-2026-54263
Wagtail: Reflected XSS in dynamic image URL generator view
6.5
CVE-2026-54261
Wagtail: Improper permission handling in image preview
6.5
CVE-2026-44200
Wagtail: Improper permission handling when copying pages
6.5
CVE-2026-44199
Wagtail: Improper permission handling when deleting form submissions
6.5
CVE-2026-44197
Wagtail: Improper permission handling when comparing revisions