CVE-2026-54259: Wagtail CMS Information Disclosure Flaw

CVE-2026-54259 Overview

CVE-2026-54259 is an information disclosure vulnerability in Wagtail, an open source content management system built on Django. The flaw exists in the Documents and Images chooser's chosen endpoint, which incorrectly lists items regardless of the user's choose permission. An authenticated user with access to the Wagtail admin can view the filename, name, and URLs of documents and images stored in collections they were not granted permission to access. The issue is classified under [CWE-280: Improper Handling of Insufficient Permissions or Privileges]. The vulnerability cannot be exploited by unauthenticated site visitors. Wagtail addressed the issue in versions 7.0.8, 7.3.3, and 7.4.2.

Critical Impact
Authenticated Wagtail admin users can enumerate filenames, names, and URLs of documents and images across collections without the required choose permission.

Affected Products

Wagtail CMS versions prior to 7.0.8
Wagtail CMS versions prior to 7.3.3
Wagtail CMS versions prior to 7.4.2

Discovery Timeline

2026-07-01 - CVE-2026-54259 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-54259

Vulnerability Analysis

The vulnerability resides in the Documents and Images chooser interface within the Wagtail admin. Wagtail uses a permission model where users must be granted choose permission on a collection to select assets from it. The chosen endpoint associated with the chooser modal failed to enforce this permission check when listing items. As a result, users with any level of Wagtail admin access could receive metadata for documents and images belonging to collections outside their permission scope.

The exposed data includes filenames, display names, and URLs. Because URLs to media assets in Wagtail can often be requested directly, disclosure of these URLs may lead to further exposure of file contents depending on storage configuration.

Root Cause

The root cause is a missing authorization check on the chooser's chosen endpoint. The endpoint returned results based on collection membership without verifying that the requesting user held the choose permission for the target collection. This aligns with CWE-280, where the application failed to properly handle insufficient privileges before returning resource metadata.

Attack Vector

Exploitation requires an authenticated account with access to the Wagtail admin interface. An attacker who obtains such credentials, or an insider with limited admin rights, can query the chooser endpoint to enumerate metadata across all collections. The attack is network-based, low complexity, and requires low privileges. No user interaction is needed. Impact is limited to confidentiality of asset metadata; integrity and availability are not affected.

Refer to the GitHub Security Advisory GHSA-h54r-xq46-qwqm for maintainer-provided technical details.

Detection Methods for CVE-2026-54259

Indicators of Compromise

Unusual volume of requests from authenticated admin users to the Wagtail chooser chosen endpoints for documents and images.
Access patterns where a single admin account enumerates asset IDs sequentially or across multiple collection boundaries.
Audit log entries showing admin users viewing or referencing assets in collections they should not have choose permission for.

Detection Strategies

Review Wagtail admin access logs for repeated queries to document and image chooser endpoints from the same session.
Correlate authenticated user activity with configured collection permissions to identify boundary crossings.
Enable Django request logging and inspect referrers pointing to chooser modals across multiple collections.

Monitoring Recommendations

Track authentication events for Wagtail admin accounts and flag accounts accessing high volumes of asset metadata.
Alert on Wagtail admin sessions from unexpected IP ranges or outside normal working hours.
Retain web server and application logs long enough to support retrospective investigation of admin activity.

How to Mitigate CVE-2026-54259

Immediate Actions Required

Upgrade Wagtail to version 7.0.8, 7.3.3, or 7.4.2 depending on the current release branch in use.
Audit Wagtail admin accounts and revoke access for users who no longer require it.
Review collection permissions and confirm that only authorized users hold choose permission on sensitive collections.

Patch Information

Wagtail maintainers released fixed versions 7.0.8, 7.3.3, and 7.4.2 that enforce the choose permission on the chooser's chosen endpoint. Administrators should upgrade using their standard package manager, for example pip install --upgrade wagtail. See the GitHub Security Advisory GHSA-h54r-xq46-qwqm for the full advisory.

Workarounds

Restrict Wagtail admin access to a minimal set of trusted users until the upgrade is applied.
Place sensitive documents and images in storage backends that require authenticated URL access rather than public URLs.
Monitor and rate-limit chooser endpoint requests at the reverse proxy or WAF layer until patching is complete.

bash

# Upgrade Wagtail to a patched release
pip install --upgrade 'wagtail>=7.4.2'

# Or, for the 7.3.x branch
pip install --upgrade 'wagtail>=7.3.3,<7.4'

# Or, for the 7.0.x branch
pip install --upgrade 'wagtail>=7.0.8,<7.1'