Executive brief
Wagtail is a popular Python-based content management system used to build and manage websites. The Documents and Images chooser endpoint failed to properly enforce access restrictions, allowing administrative users to view filenames, names, and URLs of media files in collections they should not have permission to access. While this vulnerability requires existing admin access to exploit, it could lead to exposure of sensitive file information and URLs that should remain confidential.
Technical details
This vulnerability stems from improper handling of insufficient permissions or privileges (CWE-280) in the Documents and Images chooser endpoints. The chosen endpoint failed to properly verify that users had been granted choose permission before listing items, allowing authenticated admin users to enumerate documents and images across collections beyond their authorization scope. The flaw is exploitable only to users with existing Wagtail admin access; it requires low privileges and no user interaction beyond making a network request. An attacker with admin credentials can extract sensitive metadata (filenames, display names, and URLs) of restricted media assets. Patches have been released in Wagtail 7.0.8, 7.3.3, and 7.4.2.
Affected products
- Torchbox Wagtail < 7.0.8, >= 7.1 and < 7.3.3, >= 7.4 and < 7.4.2
Timeline
- 2026-06-15: disclosed: Published by GitHub
- 2026-06-15: patched: Patches released: versions 7.0.8, 7.3.3, 7.4.2
- 2026-08-20: advisory: Reviewed and published to GitHub Advisory Database