CVE-2026-44198: Wagtail improper permission handling in page history report

Executive brief

Wagtail, a popular content management system (CMS), has a security flaw where users without permission to edit a page can still view its history report. This could allow unauthorized staff members to see sensitive information contained in previous versions of a page. Organizations using Wagtail should update to the latest patched versions to ensure proper access control.

Technical details

An improper authorization vulnerability (CWE-280) exists in Wagtail's page history reporting component. The application fails to correctly verify that a user has 'edit' permissions before granting access to the history report for a specific page. An authenticated CMS user with low privileges can exploit this over the network to view historical revisions, potentially disclosing sensitive information stored in older versions of content. The issue is resolved in Wagtail versions 7.0.7, 7.3.2, and 7.4 LTS.

Affected products

• Wagtail Wagtail < 7.0.7, >= 7.1, < 7.3.2

Timeline

• 2026-05-05: disclosed: Initial disclosure by Wagtail maintainers
• 2026-05-08: advisory: GitHub Advisory published
• 2026-05-11: other: NVD publication date

References

• https://api.github.com/users/RealOrangeOne
• https://github.com/RealOrangeOne
• https://api.github.com/users/RealOrangeOne/gists%7B/gist_id%7D
• https://api.github.com/users/RealOrangeOne/repos
• https://avatars.githubusercontent.com/u/6527489?v=4
• https://api.github.com/users/RealOrangeOne/events%7B/privacy%7D