Vulnerability GHSA-c2xx-cjmh-9q8f
Medium Risk
MEDIUM RISK
CVSS Score: 5.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 months ago
August 20, 2026 at 06:45 PM UTC
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1
Summary
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Details
Impact
The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections.
Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
Workarounds
Site owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs.
Acknowledgements
Many thanks to Ta Duc Thien for reporting this issue.
For more information
If you have any questions or comments about this advisory:
- Visit Wagtail's support channels
- Email us at [email protected] (view our security policy for more information).
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 months ago
Wagtail: Improper restriction handling on Pages admin API
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1 PYSEC-2026-3939
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1 PYSEC-2026-3939
Medium Risk
2 months ago
Wagtail: Improper restriction handling on Page translation API endpoint
0.1 - 7.0.8 and 7.1rc1 - 7.3.3 and 7.4rc1 - 7.4.2 and 8.0rc1 GHSA-jm5p-837g-rv8g
0.1 - 7.0.8 and 7.1rc1 - 7.3.3 and 7.4rc1 - 7.4.2 and 8.0rc1 GHSA-jm5p-837g-rv8g
Medium Risk
2 months ago
Wagtail: Improper permission handling when copying snippets
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1 GHSA-x5cx-w6p2-mxf2
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1 GHSA-x5cx-w6p2-mxf2
Low Risk
2 months ago
Wagtail: Identification of documents by SHA1 hash
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1 GHSA-92hv-j533-69wc
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1 GHSA-92hv-j533-69wc
Medium Risk
2 months ago
Wagtail: Improper restriction handling on Pages admin API
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1 GHSA-3vrh-m9w7-v94f
0.1 - 7.0.8 and 7.1 - 7.3.3 and 7.4 - 7.4.2 and 8.0rc1 GHSA-3vrh-m9w7-v94f
Impacted packages
Timeline
Published
2 months ago
August 20, 2026 at 06:45 PM UTC
Fixed (7.0.9)
2 months ago
August 20, 2026 at 03:27 PM UTC
Fixed (7.3.4)
2 months ago
August 20, 2026 at 03:28 PM UTC
Fixed (7.4.3)
2 months ago
August 20, 2026 at 03:28 PM UTC
Fixed (8.0rc2)
2 months ago
August 20, 2026 at 03:58 PM UTC
Last Modified
2 months ago
August 20, 2026 at 07:00 PM UTC