# Wagtail document SHA1 hash enumeration via HTTP headers

Source: https://junglewise.ai/threats/wagtail-document-sha1-hash-enumeration-via-http-headers-c56639c4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.7 · Published 2026-08-20

Wagtail, a popular open-source content management system, contains a vulnerability in its document serving endpoint that allows attackers to determine whether a specific document exists in the library by its SHA1 hash using HTTP header manipulation. The vulnerability bypasses permission restrictions and enables hash-based document enumeration, but does not expose document contents or metadata beyond the known hash value.

Technologies: [Wagtail](https://junglewise.ai/threats/technologies/wagtail). Vendors: [Wagtail](https://junglewise.ai/threats/vendors/wagtail).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.7, published 20 August 2026.

**Which products and versions are affected?** Wagtail < 7.0.9, >= 7.1 < 7.3.4, >= 7.4 < 7.4.3, = 8.0rc1.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-20: Patches released in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Wagtail's document serving endpoint, which improperly handles conditional HTTP headers (If-Match and If-None-Match) when processing requests to the `/documents/` endpoint. An attacker can leverage these headers to perform hash-matching checks against documents in the library without authentication or authorization, defeating permission controls. The root cause is improper validation of insufficient permissions when accessing document metadata. The attack requires only network access to the document serve URL; no user interaction or special privileges are needed. An attacker with a known SHA1 hash can determine whether that exact document exists in the Wagtail installation. Patches are available in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 and later. Workarounds include stripping conditional headers at the reverse proxy level or removing the file_hash attribute from custom document models.

## Affected products

- Wagtail Wagtail < 7.0.9, >= 7.1 < 7.3.4, >= 7.4 < 7.4.3, = 8.0rc1

## Timeline

- 2026-08-20: disclosed: Vulnerability advisory published
- 2026-08-20: patched: Patches released in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2

## References

- [https://api.github.com/users/gasman](https://api.github.com/users/gasman)
- [https://github.com/gasman](https://github.com/gasman)
- [https://api.github.com/users/gasman/gists%7B/gist_id%7D](https://api.github.com/users/gasman/gists%7B/gist_id%7D)
- [https://api.github.com/users/gasman/repos](https://api.github.com/users/gasman/repos)
- [https://avatars.githubusercontent.com/u/85097?v=4](https://avatars.githubusercontent.com/u/85097?v=4)
- [https://api.github.com/users/gasman/events%7B/privacy%7D](https://api.github.com/users/gasman/events%7B/privacy%7D)

## Related threats

- [Wagtail permission bypass in copy page for translation](https://junglewise.ai/threats/cve-2026-125106-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Documents and Images API access control bypass](https://junglewise.ai/threats/cve-2026-123820-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail snippet copy permission bypass](https://junglewise.ai/threats/cve-2026-123819-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Pages admin API improper access control](https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control)
- [Wagtail improper permission restriction on page translation API](https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804)