# CVE-2026-54259: Wagtail improper permissions in Documents and Images chooser

Source: https://junglewise.ai/threats/cve-2026-54259-wagtail-improper-permissions-in-documents-and-images-chooser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54259 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Wagtail is a popular Python-based content management system used to build and manage websites. The Documents and Images chooser endpoint failed to properly enforce access restrictions, allowing administrative users to view filenames, names, and URLs of media files in collections they should not have permission to access. While this vulnerability requires existing admin access to exploit, it could lead to exposure of sensitive file information and URLs that should remain confidential.

Technologies: [wagtail (PyPI)](https://junglewise.ai/threats/technologies/pypi-wagtail), [Wagtail](https://junglewise.ai/threats/technologies/wagtail). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Wagtail](https://junglewise.ai/threats/vendors/wagtail).

## Quick answers

**Is CVE-2026-54259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54259 being exploited in the wild.

**How severe is CVE-2026-54259?** Medium severity, with a CVSS score of 4.3, published 1 July 2026.

**Which products and versions are affected?** wagtail (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.8, ECOSYSTEM:introduced=0,fixed=7.0.8,introduced=7.1,fixed=7.3.3,introduced=7.4,fixed=7.4.2; Wagtail < 7.0.8, 7.1.0 to < 7.3.3, 7.4.0 to < 7.4.2.

**Is there a fix for CVE-2026-54259?** Yes. wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54259 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54259?** Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later

  ```sh
  pip install "wagtail>=7.4.2"
  ```


## Technical details

This vulnerability stems from improper handling of insufficient permissions or privileges (CWE-280) in the Documents and Images chooser endpoints. The chosen endpoint failed to properly verify that users had been granted choose permission before listing items, allowing authenticated admin users to enumerate documents and images across collections beyond their authorization scope. The flaw is exploitable only to users with existing Wagtail admin access; it requires low privileges and no user interaction beyond making a network request. An attacker with admin credentials can extract sensitive metadata (filenames, display names, and URLs) of restricted media assets. Patches have been released in Wagtail 7.0.8, 7.3.3, and 7.4.2.

## Affected products

- Torchbox Wagtail < 7.0.8, >= 7.1 and < 7.3.3, >= 7.4 and < 7.4.2

## Identifiers

- CVE-2026-54259
- GHSA-h54r-xq46-qwqm
- PYSEC-2026-612

## Timeline

- 2026-06-15: disclosed: Published by GitHub
- 2026-06-15: patched: Patches released: versions 7.0.8, 7.3.3, 7.4.2
- 2026-08-20: advisory: Reviewed and published to GitHub Advisory Database

## References

- [https://api.github.com/users/harshakshit](https://api.github.com/users/harshakshit)
- [https://github.com/harshakshit](https://github.com/harshakshit)
- [https://api.github.com/users/harshakshit/gists%7B/gist_id%7D](https://api.github.com/users/harshakshit/gists%7B/gist_id%7D)
- [https://api.github.com/users/harshakshit/repos](https://api.github.com/users/harshakshit/repos)
- [https://avatars.githubusercontent.com/u/42298609?v=4](https://avatars.githubusercontent.com/u/42298609?v=4)
- [https://api.github.com/users/harshakshit/events%7B/privacy%7D](https://api.github.com/users/harshakshit/events%7B/privacy%7D)

## Related threats

- [Wagtail permission bypass in copy page for translation](https://junglewise.ai/threats/cve-2026-125106-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Documents and Images API access control bypass](https://junglewise.ai/threats/cve-2026-123820-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail snippet copy permission bypass](https://junglewise.ai/threats/cve-2026-123819-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Pages admin API improper access control](https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control)
- [Wagtail improper permission restriction on page translation API](https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804)