CVE-2026-54259: Wagtail improper permissions in Documents and Images chooser

CVE-2026-54259 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Wagtail is a popular Python-based content management system used to build and manage websites. The Documents and Images chooser endpoint failed to properly enforce access restrictions, allowing administrative users to view filenames, names, and URLs of media files in collections they should not have permission to access. While this vulnerability requires existing admin access to exploit, it could lead to exposure of sensitive file information and URLs that should remain confidential.

Technologies: wagtail (PyPI), Wagtail. Vendors: PyPI, Wagtail.

Quick answers

Is CVE-2026-54259 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54259 being exploited in the wild.
How severe is CVE-2026-54259?
Medium severity, with a CVSS score of 4.3, published 1 July 2026.
Which products and versions are affected?
wagtail (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.8, ECOSYSTEM:introduced=0,fixed=7.0.8,introduced=7.1,fixed=7.3.3,introduced=7.4,fixed=7.4.2; Wagtail < 7.0.8, 7.1.0 to < 7.3.3, 7.4.0 to < 7.4.2.
Is there a fix for CVE-2026-54259?
Yes. wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54259 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54259?
Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later
    pip install "wagtail>=7.4.2"

Technical details

This vulnerability stems from improper handling of insufficient permissions or privileges (CWE-280) in the Documents and Images chooser endpoints. The chosen endpoint failed to properly verify that users had been granted choose permission before listing items, allowing authenticated admin users to enumerate documents and images across collections beyond their authorization scope. The flaw is exploitable only to users with existing Wagtail admin access; it requires low privileges and no user interaction beyond making a network request. An attacker with admin credentials can extract sensitive metadata (filenames, display names, and URLs) of restricted media assets. Patches have been released in Wagtail 7.0.8, 7.3.3, and 7.4.2.

Affected products

  • Torchbox Wagtail < 7.0.8, >= 7.1 and < 7.3.3, >= 7.4 and < 7.4.2

Identifiers

  • CVE-2026-54259
  • GHSA-h54r-xq46-qwqm
  • PYSEC-2026-612

Timeline

  • 2026-06-15: disclosed: Published by GitHub
  • 2026-06-15: patched: Patches released: versions 7.0.8, 7.3.3, 7.4.2
  • 2026-08-20: advisory: Reviewed and published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.