Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M

CVE-2026-25517Wagtail has improper permission handling on admin preview endpoints

Medium 5.1

In plain English

A medium-severity missing authorization in wagtail from wagtail. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 67.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	wagtail	6.3.6	GHSA-4qvv-g3vr-m348
PyPI	wagtail	7.0.4	GHSA-4qvv-g3vr-m348
PyPI	wagtail	7.1.3	GHSA-4qvv-g3vr-m348
PyPI	wagtail	7.2.2	GHSA-4qvv-g3vr-m348
PyPI	wagtail	7.3	GHSA-4qvv-g3vr-m348
PyPI	wagtail	6.3.6, 7.0.4, 7.1.3, 7.2.2, 7.3	PYSEC-2026-2030

Affected products (as reported)

Vendor	Product	Versions
wagtail	wagtail	< 6.3.6>= 6.4rc1, < 7.0.4>= 7.1rc1, < 7.1.3>= 7.2rc1, < 7.2.2= 7.3rc1

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/wagtail/wagtail/security/advisories/GHSA-4qvv-g3vr-m348 x_refsource_CONFIRM
https://github.com/wagtail/wagtail/commit/01fd3477365a193e6a8270311defb76e890d2719 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/5f09b6da61e779b0e8499bdbba52bf2f7bd3241f x_refsource_MISC
https://github.com/wagtail/wagtail/commit/73f070dbefbd3b39ea6649ce36bd2d2a6eef2190 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/7dfe8de5f8b3f112c73c87b6729197db16454915 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/dd824023a031f1b82a6b6f83a97a5c73391b7c03 x_refsource_MISC