Executive brief
Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
Affected products
- PyPI wagtail
Junglewise Threat Intelligence
CVE-2024-32882: PYSEC-2026-2031 - Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
CVE-2024-32882 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: wagtail (PyPI). Vendors: PyPI.
Related threats
- Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective r
- PYSEC-2026-2030 - Wagtail has improper permission handling on admin preview endpoints
- PYSEC-2026-2032 - Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`
- Wagtail reflected XSS in dynamic image URL generator
- Wagtail improper permission handling in simple_translation