CVE-2026-55468: Wagtail CMS Information Disclosure Flaw

CVE-2026-55468 Overview

Wagtail is an open source content management system built on Django. CVE-2026-55468 is a broken access control vulnerability [CWE-280] in the internal Pages admin API. The API returns page fields declared in api_fields without applying sufficient page-level permission checks. An authenticated user with Wagtail admin access can retrieve restricted draft and live page content that they should not be authorized to view. The issue is fixed in Wagtail versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Critical Impact
Authenticated Wagtail admin users can bypass page permission boundaries and read restricted draft or live content through the internal admin API.

Affected Products

Wagtail CMS versions prior to 7.0.9 on the 7.0.x line
Wagtail CMS versions prior to 7.3.4 and 7.4.3 on the 7.3.x and 7.4.x lines
Wagtail CMS pre-release versions prior to 8.0rc2

Discovery Timeline

2026-08-24 - CVE-2026-55468 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55468

Vulnerability Analysis

The vulnerability resides in Wagtail's internal admin API layer at wagtail/admin/api/views.py. This API serves page data to the Wagtail admin interface and exposes fields declared in each page model's api_fields attribute. The endpoint validates that the caller has general admin access, but it does not enforce the per-page permission policy governing which pages a user can view or edit.

As a result, any authenticated user with a Wagtail admin session can query the internal Pages admin API and retrieve fields from pages outside their permission scope. This includes both live pages restricted by group permissions and unpublished draft content awaiting review. The exposure is limited to data readable through api_fields declarations, but for many sites this includes sensitive editorial content, unreleased announcements, or restricted section pages.

Root Cause

The root cause is missing authorization enforcement in the admin API viewset. The code inherits from PagesAPIViewSet and applies standard queryset filtering, but omits calls into PagePermissionPolicy to filter results by the requesting user's page permissions. This is a classic Improper Handling of Insufficient Permissions or Privileges weakness [CWE-280].

Attack Vector

Exploitation requires an authenticated Wagtail account with any level of admin access. The attacker issues HTTP requests to the internal admin Pages API endpoint and enumerates page IDs. The API returns api_fields data for pages the user should not be able to view, including drafts. No user interaction beyond the attacker's own session is required.

python

# Security patch in wagtail/admin/api/views.py
# Adds page permission policy enforcement to the admin API viewset

from wagtail.api.v2.views import PagesAPIViewSet
from wagtail.models import Page
+from wagtail.permission_policies.pages import PagePermissionPolicy

from .actions.convert_alias import ConvertAliasPageAPIAction
from .actions.copy import CopyPageAPIAction

Source: Wagtail Commit 5608cfb

The patch imports PagePermissionPolicy so the admin API view can filter querysets against the requesting user's page permissions before returning results.

Detection Methods for CVE-2026-55468

Indicators of Compromise

Authenticated requests to internal Wagtail admin API endpoints (typically under /admin/api/) returning page objects the requesting user's group should not have permission to view.
Elevated request volume from a single admin session enumerating sequential page IDs through the admin API.
Access log entries showing admin API responses for draft or restricted pages correlated with user accounts that lack explicit page permissions.

Detection Strategies

Review Django and web server access logs for calls to /admin/api/ endpoints and correlate returned page IDs with the caller's PagePermissionPolicy scope.
Enable Wagtail audit logging and alert on admin API responses that reference pages outside a user's assigned tree location.
Compare current Wagtail version in deployment inventory against fixed versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 to identify vulnerable installations.

Monitoring Recommendations

Instrument the Wagtail admin API with per-user response counters and alert on anomalous fan-out patterns indicative of enumeration.
Forward Django application logs and web server logs to a centralized SIEM for retention and query.
Monitor for creation of low-privilege admin accounts followed by rapid internal API activity, which may indicate exploitation attempts.

How to Mitigate CVE-2026-55468

Immediate Actions Required

Upgrade Wagtail to 7.0.9, 7.3.4, 7.4.3, or 8.0rc2 depending on the deployed release line.
Audit existing Wagtail admin user accounts and remove or downgrade any accounts that no longer require access.
Review recent admin API access logs for signs of unauthorized retrieval of draft or restricted page content.

Patch Information

The fix is delivered in Wagtail versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2. The patch modifies wagtail/admin/api/views.py to import and apply PagePermissionPolicy (and, in the 8.0 line, policy_registry) so the admin API filters querysets against the requesting user's page permissions. See the Wagtail Security Advisory GHSA-3vrh-m9w7-v94f and the fix commits 5608cfb, aef9355, d99d2be, and e2fa629.

Workarounds

Restrict access to the Wagtail admin interface at the network layer (VPN, IP allowlist) until the upgrade is applied.
Temporarily reduce the number of accounts with any admin privilege to trusted users only.
Remove or minimize api_fields declarations that expose sensitive attributes on restricted page models until patched versions are deployed.

bash

# Upgrade Wagtail to a fixed version using pip
pip install --upgrade "wagtail==7.4.3"

# Or pin the appropriate fixed release for your line in requirements.txt
# wagtail==7.0.9
# wagtail==7.3.4
# wagtail==7.4.3
# wagtail==8.0rc2

# Verify installed version
python -c "import wagtail; print(wagtail.__version__)"