CVE-2026-44197: Wagtail improper permission handling in revision compare view

Executive brief

Wagtail, a popular content management system (CMS), has a security flaw in how it handles user permissions for viewing page history. An authorized CMS user who does not have permission to edit a specific page could still view its previous versions and potentially sensitive content by guessing the identification numbers of those versions. This could lead to the unauthorized disclosure of private or draft information.

Technical details

An improper permission handling vulnerability (CWE-280) exists in Wagtail's revision comparison view. The root cause is insufficient authorization checks when a user requests to compare two page revisions. An attacker with basic CMS access, but without edit permissions for a specific page, can bypass access controls by directly accessing the revision comparison interface if they know or can guess the primary keys of the revisions. This allows for unauthorized disclosure of sensitive information contained within those revisions. The issue is fixed in Wagtail versions 7.0.7, 7.3.2, and 7.4 LTS.

Affected products

• Wagtail Wagtail < 7.0.7, >= 7.1, < 7.3.2

Timeline

• 2026-05-08: advisory: GitHub Advisory published
• 2026-05-11: advisory: NVD published

References

• https://api.github.com/users/RealOrangeOne
• https://github.com/RealOrangeOne
• https://api.github.com/users/RealOrangeOne/gists%7B/gist_id%7D
• https://api.github.com/users/RealOrangeOne/repos
• https://avatars.githubusercontent.com/u/6527489?v=4
• https://api.github.com/users/RealOrangeOne/events%7B/privacy%7D