CVE-2026-44197
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
May 11, 2026
CISA due date
—
The record
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-21099 Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local… CWE-280
- CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner… CWE-280
- CVE-2026-73239 Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple… CWE-280
- CVE-2026-18860 Velociraptor allows multi-tenant deployments named "Orgs". CWE-280
- CVE-2026-45195 Kernel software installed and running inside a Host VM may post improper commands to the… CWE-280
- CVE-2026-41566 Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache… CWE-280
- CVE-2026-40371 Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365… CWE-280
- CVE-2026-11764 When creating an export of all reusable media, the secrets of connected gift cards were… CWE-280