CVE-2026-44199: Wagtail improper permission handling in form submission deletion

Executive brief

Wagtail, a popular open-source content management system (CMS), contains a flaw in how it handles permissions for form submissions. An internal user with limited access can delete form data from pages they are not authorized to manage by manipulating web requests. This could lead to the unauthorized loss of customer-submitted data and disrupt business operations that rely on those forms.

Technical details

Wagtail is vulnerable to improper handling of insufficient permissions (CWE-280) within its form submission management component. A CMS user with restricted access can bypass intended authorization checks by crafting a malicious form submission request. This allows the attacker to delete form submissions associated with pages they are not permitted to manage. The attack requires the attacker to have at least low-level 'limited access' privileges within the Wagtail admin interface. The issue is resolved in versions 7.0.7, 7.3.2, and 7.4 LTS.

Affected products

• Wagtail Wagtail < 7.0.7, >= 7.1, < 7.3.2

Timeline

• 2026-05-05: patched: Patched versions 7.0.7 and 7.3.2 released.
• 2026-05-08: disclosed: GitHub Advisory published.
• 2026-05-11: advisory: NVD published CVE-2026-44199.

References

• https://api.github.com/users/RealOrangeOne
• https://github.com/RealOrangeOne
• https://api.github.com/users/RealOrangeOne/gists%7B/gist_id%7D
• https://api.github.com/users/RealOrangeOne/repos
• https://avatars.githubusercontent.com/u/6527489?v=4
• https://api.github.com/users/RealOrangeOne/events%7B/privacy%7D