Missing Permission Check Vulnerability in Wagtail Content Management System
CVE-2026-25517
What is CVE-2026-25517?
Wagtail, an open-source content management system based on Django, has a vulnerability that allows a user with access to the Wagtail admin to exploit missing permission checks on preview endpoints. This flaw enables the crafting of a form submission to obtain a preview rendering of any page, snippet, or site setting enabled for previews. While the exposed data does not include the existing object itself, it may inadvertently reveal other database contents that should only be accessible to users with higher edit permissions. This vulnerability requires access to the Wagtail admin and is mitigated in versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3.
Affected Version(s)
wagtail < 6.3.6 < 6.3.6
wagtail >= 6.4rc1, < 7.0.4 < 6.4rc1, 7.0.4
wagtail >= 7.1rc1, < 7.1.3 < 7.1rc1, 7.1.3