CVE-2026-55468mediumCWE-280

CVE-2026-55468: falha de média gravidade em wagtail

Wagtail: Improper restriction handling on Pages admin API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar wagtail+ Monitorar wagtail

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
wagtail · wagtail
CVEs relacionadas — wagtail

No mesmo produto, das mais perigosas para as menos.

CVE-2020-11001MEDIUMPossible XSS attack in WagtailEPSS 1.3%CVE-2021-32681MEDIUMImproper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocksEPSS 1.1%CVE-2020-15118MEDIUMCross-Site Scripting in WagtailEPSS 1.1%CVE-2023-28837MEDIUMWagtail vulnerable to denial-of-service via memory exhaustion when uploading large filesEPSS 1.1%CVE-2022-21683LOWComment reply notifications sent to incorrect users in wagtailEPSS 1.0%CVE-2023-28836MEDIUMWagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin viewsEPSS 0.8%