CVE-2026-55468

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2

Description The internal Pages admin API returns page fields declared in api fields without sufficient access control. This allows a user with Wagtail admin access to retrieve restricted draft and live page content, including base page model fields such as title, slug, seo title, and search description, as well as any custom fields defined in api fields.

Recommendations Update to version 7.0.9. Update to version 7.3.4. Update to version 7.4.3. Update to version 8.0rc2. As a temporary workaround, override the get base queryset method on PagesAdminAPIViewSet to restrict the queryset using page permission policy.explorable instances(self.request.user).