Harshakshit

**Name of the Vulnerable Software and Affected Versions** Wagtail versions prior to 7.0.8 Wagtail versions prior to 7.3.3 Wagtail versions prior to 7.4.2 **Description** The Documents and Images chooser's chosen endpoint incorrectly lists items for which the user has not been granted choose permission. A user with access to the Wagtail admin can view the filename, name, and URLs of documents and images within those collections. This issue is not exploitable by site visitors who lack access to the Wagtail admin. **Recommendations** Update to version 7.0.8 Update to version 7.3.3 Update to version 7.4.2

**Name of the Vulnerable Software and Affected Versions** Wagtail versions prior to 7.0.8 Wagtail versions prior to 7.3.3 Wagtail versions prior to 7.4.2 **Description** A missing permission check on the image preview endpoint allows a user with access to the Wagtail admin to preview any image. This issue does not expose the image object data and cannot be exploited by site visitors who lack admin access. **Recommendations** Update to version 7.0.8. Update to version 7.3.3. Update to version 7.4.2.