Vulnerability PYSEC-2026-3939

Medium Risk

2 months ago

Wagtail: Improper restriction handling on Pages admin API

0.1 and 0.2 and 0.3 and 0.3.1 and 0.4 and 0.4.1 and 0.5 and 0.6 and 0.7 and 0.8 and 0.8.1 - 0.8.10 and 1.0b1 and 1.0b2 and 1.0rc1 and 1.0rc2 and 1.0 and 1.1rc1 and 1.1 and 1.2rc1 and 1.2 and 1.3rc1 and 1.3 and 1.3.1 and 1.4rc1 and 1.4 and 1.4.1 - 1.4.6 and 1.5rc1 and 1.5 and 1.5.1 - 1.5.3 and 1.6rc1 and 1.6 and 1.6.1 - 1.6.3 and 1.7rc1 and 1.7 and 1.8rc1 and 1.8 and 1.8.1 - 1.8.2 and 1.9rc1 and 1.9 and 1.9.1 and 1.10rc1 and 1.10 and 1.10.1 and 1.11rc1 and 1.11 and 1.11.1 and 1.12rc1 and 1.12 and 1.12.1 - 1.12.6 and 1.13rc1 and 1.13 and 1.13.1 - 1.13.4 and 2.0b1 and 2.0rc1 and 2.0 and 2.0.1 - 2.0.2 and 2.1rc1 and 2.1rc2 and 2.1 and 2.1.1 - 2.1.3 and 2.2rc1 and 2.2rc2 and 2.2 and 2.2.1 - 2.2.2 and 2.3rc1 and 2.3rc2 and 2.3 and 2.4rc1 and 2.4 and 2.5rc1 and 2.5 and 2.5.1 - 2.5.2 and 2.6rc1 and 2.6 and 2.6.1 - 2.6.3 and 2.7rc1 and 2.7rc2 and 2.7 and 2.7.1 - 2.7.4 and 2.8rc1 and 2.8 and 2.8.1 - 2.8.2 and 2.9rc1 and 2.9 and 2.9.1 - 2.9.3 and 2.10rc1 and 2.10rc2 and 2.10 and 2.10.1 - 2.10.2 and 2.11rc1 and 2.11 and 2.11.1 - 2.11.9 and 2.12rc1 and 2.12 and 2.12.1 - 2.12.6 and 2.13rc1 and 2.13rc2 and 2.13rc3 and 2.13 and 2.13.1 - 2.13.5 and 2.14rc1 and 2.14 and 2.14.1 - 2.14.2 and 2.15rc1 and 2.15rc2 and 2.15 and 2.15.1 - 2.15.6 and 2.16rc1 and 2.16rc2 and 2.16 and 2.16.1 - 2.16.3 and 3.0rc1 and 3.0rc2 and 3.0rc3 and 3.0 and 3.0.1 - 3.0.3 and 4.0rc1 and 4.0rc2 and 4.0 and 4.0.1 - 4.0.4 and 4.1rc1 and 4.1 and 4.1.1 - 4.1.9 and 4.2rc1 and 4.2 and 4.2.1 - 4.2.4 and 5.0rc1 and 5.0 and 5.0.1 - 5.0.5 and 5.1rc1 and 5.1 and 5.1.1 - 5.1.3 and 5.2rc1 and 5.2 and 5.2.1 - 5.2.8 and 6.0rc1 and 6.0 and 6.0.1 - 6.0.6 and 6.1rc1 and 6.1rc2 and 6.1 and 6.1.1 - 6.1.3 and 6.2rc1 and 6.2 and 6.2.1 - 6.2.4 and 6.3rc1 and 6.3rc2 and 6.3 and 6.3.1 - 6.3.8 and 6.4rc1 and 6.4 and 6.4.1 - 6.4.2 and 7.0rc1 and 7.0 and 7.0.1 - 7.0.8 and 7.1 and 7.1.1 - 7.1.3 and 7.2rc1 and 7.2 and 7.2.1 - 7.2.3 and 7.3rc1 and 7.3 and 7.3.1 - 7.3.3 and 7.4 and 7.4.1 - 7.4.2 and 8.0rc1

Summary

Wagtail: Improper restriction handling on Pages admin API

Details

Impact

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

# wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy


def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset