CVE-2026-123820

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2

Description The Documents and Images API V2 fails to exclude descendant collections when the ancestor collection is restricted. Because descendants inherit view restrictions from their ancestors, an API user can list the names and filenames of documents and images stored in these descendant collections that are intended to remain private.

Recommendations Update to version 7.0.9 Update to version 7.3.4 Update to version 7.4.3 Update to version 8.0rc2