CVE-2026-44197
Wagtail: Improper permission handling when comparing revisions
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Wagtail: Improper permission handling when comparing revisions
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
CVE-2026-44197- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
EUVDEUVD-2026-29073
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
EUVD-2026-29073- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c6wj-9vcj-75pj
Wagtail has improper permission handling when comparing revisions
Impact
A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Many thanks to Seoyoung Kang @seoyoung-kang from AhnLab and an independent security researcher for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels
- Send an email to [email protected] (view the security policy for more information).
- Record
GHSA-c6wj-9vcj-75pj- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
NVD
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
CVE-2026-44197- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSV
Wagtail: Improper permission handling when comparing revisions
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
CVE-2026-44197- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSVGHSA-c6wj-9vcj-75pj
Wagtail has improper permission handling when comparing revisions
Impact
A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Many thanks to Seoyoung Kang @seoyoung-kang from AhnLab and an independent security researcher for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels
- Send an email to [email protected] (view the security policy for more information).
- Record
GHSA-c6wj-9vcj-75pj- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSVPYSEC-2026-146
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
PYSEC-2026-146- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-44197 No score
CVE-2026-44197 in rootio-wagtail - Patched by Root
Root has patched CVE-2026-44197 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-44197- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wagtailPyPI |
before 7.0.7 | 7.0.7 |
wagtailPyPI |
7.1 up to 7.3.2 | 7.3.2 |
wagtailPyPI |
before 7.0.7, plus listed versions 0.10.20.30.3.10.4 Show 45 moreShow less0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3 |
7.0.7 |
wagtailPyPI |
7.1 up to 7.3.2, plus listed versions 7.1.17.1.27.1.37.27.2.1 Show 6 moreShow less7.2.27.2.37.2rc17.37.3.17.3rc1 |
7.3.2 |
wagtailPyPI |
before 7.0.7, 7.1 up to 7.3.2, plus listed versions 0.10.20.30.3.10.4 Show 45 moreShow less0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3 |
7.0.77.3.2 |
rootio-wagtailRoot:PyPI |
before 4.2.3+root.io.1 | 4.2.3+root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44197 is a medium vulnerability (CVSS 6.5) in Torchbox Wagtail, published May 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in wagtail 7.0.7.
References
github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj
nvd.nist.gov/vuln/detail/CVE-2026-44197
Left out here: 457 versions. The JSON record has them.