Every CVE Search/ Get API key

CVE-2026-44198

Wagtail: Improper permission handling when viewing page history

4.3 MediumFix available

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.16%Up 0.1 points since May 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.3

Wagtail: Improper permission handling when viewing page history

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Record
CVE-2026-44198
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-280
Updated
2026-11-02
EUVDEUVD-2026-29074 4.3

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Record
EUVD-2026-29074
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-c4mr-889m-vgf6 4.3

Wagtail has improper permission handling when viewing page history

Impact

A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks Seoyoung Kang @seoyoung-kang who is from AhnLab and also an independent security researcher for reporting this issue.

For more information

If there are any questions or comments about this advisory:

Record
GHSA-c4mr-889m-vgf6
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-280
Updated
2026-11-02
NVD 4.3

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Record
CVE-2026-44198
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-280
Updated
2026-11-02
OSV 4.3

Wagtail: Improper permission handling when viewing page history

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Record
CVE-2026-44198
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-280
Updated
2026-11-02
OSVGHSA-c4mr-889m-vgf6 4.3

Wagtail has improper permission handling when viewing page history

Impact

A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks Seoyoung Kang @seoyoung-kang who is from AhnLab and also an independent security researcher for reporting this issue.

For more information

If there are any questions or comments about this advisory:

Record
GHSA-c4mr-889m-vgf6
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-280
Updated
2026-11-02
OSVPYSEC-2026-147 4.3

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Record
PYSEC-2026-147
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-44198 No score

CVE-2026-44198 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-44198 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-44198
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wagtail
PyPI
 before 7.0.7
7.0.7
wagtail
PyPI
 7.1 up to 7.3.2
7.3.2
wagtail
PyPI
 before 7.0.7, plus listed versions
0.10.20.30.3.10.4
Show 45 moreShow less
0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3
7.0.7
wagtail
PyPI
 7.1 up to 7.3.2, plus listed versions
7.1.17.1.27.1.37.27.2.1
Show 6 moreShow less
7.2.27.2.37.2rc17.37.3.17.3rc1
7.3.2
wagtail
PyPI
 before 7.0.7, 7.1 up to 7.3.2, plus listed versions
0.10.20.30.3.10.4
Show 45 moreShow less
0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3
7.0.77.3.2
rootio-wagtail
Root:PyPI
 before 4.2.3+root.io.1
4.2.3+root.io.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44198 is a medium vulnerability (CVSS 4.3) in Torchbox Wagtail, published May 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in wagtail 7.0.7.

References

This page doesn't list everything

Left out here: 457 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open