Wagtail: Improper restriction handling on Pages admin API

ImpactThe internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...

PYSEC-2026-3939 Wagtail: Improper restriction handling on Pages admin API

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

Wagtail: Improper restriction handling on Pages admin API

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...

Improper Handling of Insufficient Permissions or Privileges

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the PagesAdminAPIViewSet class. An attacker can access sensitive page field contents by sending...

PT-2026-80213

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in api fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api fields on the base page model title, slug, s...