Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 5.3, published 20 August 2026.
- Which products and versions are affected?
- Wagtail Wagtail < 7.0.9, >= 7.1 and < 7.3.4, >= 7.4 and < 7.4.3, = 8.0rc1.
- Is there a fix for This vulnerability?
- A patch was published on 2026-08-20: Patches released in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a failure to properly enforce authorization/permission inheritance in the API layer (CWE-280: Improper Handling of Insufficient Permissions). The Documents and Images API V2 did not correctly apply view restrictions defined on parent collections to their descendant collections, allowing unauthenticated or low-privileged API users to enumerate and view metadata of restricted resources. The attack requires network access to the API endpoint with no authentication required. The impact is limited to confidentiality (metadata disclosure); integrity and availability are not affected. Patches are available in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2. A temporary workaround is to add authentication to the API endpoints.
Affected products
- Wagtail Wagtail < 7.0.9, >= 7.1 and < 7.3.4, >= 7.4 and < 7.4.3, = 8.0rc1
Timeline
- 2026-08-20: disclosed: Advisory published
- 2026-08-20: patched: Patches released in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2