CVE-2026-44201CWE-280

Wagtail: Improper restriction handling on Documents and Images API

Medium · published May 11, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00313 · 22.9th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2026-05-11T14:42Z
EPSS history
Timeline
  • 11 MAY 14:42Z
    Wagtail: Improper restriction handling on Documents and Images API
    cvelistv5