CVE-2026-44199
Wagtail: Improper permission handling when deleting form submissions
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Wagtail: Improper permission handling when deleting form submissions
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
CVE-2026-44199- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
EUVDEUVD-2026-29075
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
EUVD-2026-29075- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pwm3-7fv4-g6xx
Wagtail has improper permission handling when deleting form submissions
Impact
A CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Wagtail thanks Vishal Shukla @shukla304 for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels
- Send an email to [email protected] (view the security policy for more information).
- Record
GHSA-pwm3-7fv4-g6xx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
NVD
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
CVE-2026-44199- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSV
Wagtail: Improper permission handling when deleting form submissions
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
CVE-2026-44199- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSVGHSA-pwm3-7fv4-g6xx
Wagtail has improper permission handling when deleting form submissions
Impact
A CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Wagtail thanks Vishal Shukla @shukla304 for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels
- Send an email to [email protected] (view the security policy for more information).
- Record
GHSA-pwm3-7fv4-g6xx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-280
- Updated
- 2026-11-02
OSVPYSEC-2026-148
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Record
PYSEC-2026-148- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-44199 No score
CVE-2026-44199 in rootio-wagtail - Patched by Root
Root has patched CVE-2026-44199 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-44199- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wagtailPyPI |
before 7.0.7 | 7.0.7 |
wagtailPyPI |
7.1 up to 7.3.2 | 7.3.2 |
wagtailPyPI |
before 7.0.7, plus listed versions 0.10.20.30.3.10.4 Show 45 moreShow less0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3 |
7.0.7 |
wagtailPyPI |
7.1 up to 7.3.2, plus listed versions 7.1.17.1.27.1.37.27.2.1 Show 6 moreShow less7.2.27.2.37.2rc17.37.3.17.3rc1 |
7.3.2 |
wagtailPyPI |
before 7.0.7, 7.1 up to 7.3.2, plus listed versions 0.10.20.30.3.10.4 Show 45 moreShow less0.4.10.50.60.70.80.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.01.0b11.0b21.0rc11.0rc21.11.101.10.11.10rc11.111.11.11.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.1rc11.21.2rc11.3 |
7.0.77.3.2 |
rootio-wagtailRoot:PyPI |
before 4.2.3+root.io.1 | 4.2.3+root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44199 is a medium vulnerability (CVSS 6.5) in Torchbox Wagtail, published May 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in wagtail 7.0.7.
References
github.com/wagtail/wagtail/security/advisories/GHSA-pwm3-7fv4-g6xx
nvd.nist.gov/vuln/detail/CVE-2026-44199
Left out here: 457 versions. The JSON record has them.