CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Impact

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

# wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy


def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Acknowledgements

Many thanks to xuliang@QAX for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at [email protected] (view our security policy for more information).

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Impact

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

# wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy


def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Acknowledgements

Many thanks to xuliang@QAX for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at [email protected] (view our security policy for more information).

Impact

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

# wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy


def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Acknowledgements

Many thanks to xuliang@QAX for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at [email protected] (view our security policy for more information).