GHSA-4qvv-g3vr-m348
NoneCVSS
—
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
Wagtail has improper permission handling on admin preview endpoints
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | wagtail | 0 | 6.3.6 |
| PyPI | wagtail | 6.4rc1 | 7.0.4 |
| PyPI | wagtail | 7.1rc1 | 7.1.3 |
| PyPI | wagtail | 7.2rc1 | 7.2.2 |
| PyPI | wagtail | 7.3rc1 | 7.3 |
Related vulnerabilities
- CVE-2026-25517 Wagtail is an open source content management system built on Django. Same vulnerability
- CVE-2026-28223 Wagtail is an open source content management system built on Django. Also affects wagtail
- CVE-2026-28222 Wagtail is an open source content management system built on Django. Also affects wagtail
- GHSA-p4v8-rw59-93cq Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface Also affects wagtail
- GHSA-p5cm-246w-84jm Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes Also affects wagtail
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862
- CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. CWE-862