Wagtail improper restriction handling in Documents and Images API

Executive brief

Wagtail is a content management system with an API for accessing documents and images. The API failed to properly enforce access restrictions on private collections and their subfolders, allowing unauthorized users to view filenames and metadata of restricted content. This exposes sensitive document and image names that should have been hidden from public access.

Technical details

The vulnerability is a failure to properly enforce authorization/permission inheritance in the API layer (CWE-280: Improper Handling of Insufficient Permissions). The Documents and Images API V2 did not correctly apply view restrictions defined on parent collections to their descendant collections, allowing unauthenticated or low-privileged API users to enumerate and view metadata of restricted resources. The attack requires network access to the API endpoint with no authentication required. The impact is limited to confidentiality (metadata disclosure); integrity and availability are not affected. Patches are available in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2. A temporary workaround is to add authentication to the API endpoints.

Affected products

• Wagtail Wagtail < 7.0.9, >= 7.1 and < 7.3.4, >= 7.4 and < 7.4.3, = 8.0rc1

Timeline

• 2026-08-20: disclosed: Advisory published
• 2026-08-20: patched: Patches released in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2

References

• https://api.github.com/users/gasman
• https://github.com/gasman
• https://api.github.com/users/gasman/gists%7B/gist_id%7D
• https://api.github.com/users/gasman/repos
• https://avatars.githubusercontent.com/u/85097?v=4
• https://api.github.com/users/gasman/events%7B/privacy%7D