Executive brief
Wagtail has improper permission handling on admin preview endpoints
Affected products
- PyPI wagtail
Junglewise Threat Intelligence
CVE-2026-25517: PYSEC-2026-2030 - Wagtail has improper permission handling on admin preview endpoints
CVE-2026-25517 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: wagtail (PyPI). Vendors: PyPI.
Related threats
- Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective r
- PYSEC-2026-2032 - Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`
- PYSEC-2026-2031 - Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
- Wagtail reflected XSS in dynamic image URL generator
- Wagtail improper permission handling in simple_translation