Medium severity · published Aug 24, 2026
CVE-2026-55468
Wagtail: Improper restriction handling on Pages admin API
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wagtail · wagtail
< 7.0.9; >= 7.1, < 7.3.4; >= 7.4, < 7.4.3; >= 8.0rc1, < 8.0rc2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55468
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55468
github.com
https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975
github.com
https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4
github.com
https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559
github.com
https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3
github.com
https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f
More from wagtail
7.3
CVE-2026-54263
Wagtail: Reflected XSS in dynamic image URL generator view
6.5
CVE-2026-54261
Wagtail: Improper permission handling in image preview
6.5
CVE-2026-44200
Wagtail: Improper permission handling when copying pages
6.5
CVE-2026-44199
Wagtail: Improper permission handling when deleting form submissions
6.5
CVE-2026-44197
Wagtail: Improper permission handling when comparing revisions