# CVE-2022-21683: Comment reply notifications sent to incorrect users

Source: https://junglewise.ai/threats/cve-2022-21683-comment-reply-notifications-sent-to-incorrect-users  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-18  
License: CC BY 4.0 with a link back

CVE-2022-21683 · Severity: low · CVSS 3.1 · Published 2022-01-18

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not have editing access to, as long as they have left a comment or reply somewhere on the site. A patched version has been released as Wagtail 2.15.2, which restores the intended behaviour - to send notifications for new replies to the participants in the active thread only (editing permissions are not considered). New comments can be disabled by setting `WAGTAILADMIN_COMMENTS_ENABLED = False` in the Django settings file.

Technologies: [wagtail (PyPI)](https://junglewise.ai/threats/technologies/pypi-wagtail). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-21683 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-21683 being exploited in the wild.

**How severe is CVE-2022-21683?** Low severity, with a CVSS score of 3.1, published 18 January 2022.

**Which products and versions are affected?** wagtail (PyPI) ECOSYSTEM:introduced=2.13,fixed=2.15.2, GIT:introduced=0,fixed=5fe901e5d86ed02dbbb63039a897582951266afd|ECOSYSTEM:introduced=2.13,fixed=2.15.2.

**Is there a fix for CVE-2022-21683?** Yes. wagtail (PyPI): upgrade to 2.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-21683?** Check whether you run wagtail (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wagtail (PyPI): upgrade to 2.15.2 or later

  ```sh
  pip install "wagtail>=2.15.2"
  ```


## Affected products

- wagtail (PyPI) ECOSYSTEM:introduced=2.13,fixed=2.15.2, GIT:introduced=0,fixed=5fe901e5d86ed02dbbb63039a897582951266afd|ECOSYSTEM:introduced=2.13,fixed=2.15.2

## Identifiers

- CVE-2022-21683
- GHSA-xqxm-2rpm-3889
- PYSEC-2022-13

## Related threats

- [Wagtail Pages admin API improper access control](https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control)
- [PYSEC-2026-2030 - Wagtail has improper permission handling on admin preview endpoints](https://junglewise.ai/threats/cve-2026-25517-wagtail-has-improper-permission-handling-on-admin-preview)
- [PYSEC-2026-2032 - Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`](https://junglewise.ai/threats/cve-2024-35228-improper-handling-of-insufficient-permissions-in-wagtail-contrib)
- [PYSEC-2026-2031 - Wagtail has permission check bypass when editing a model with per-field restrictions through…](https://junglewise.ai/threats/cve-2024-32882-wagtail-has-permission-check-bypass-when-editing-a-model-with-per)
- [Wagtail reflected XSS in dynamic image URL generator](https://junglewise.ai/threats/cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator)