DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-C2XX-CJMH-9Q8F: GHSA-C2XX-CJMH-9Q8F: Information Disclosure via Inherited Collection View Restriction Bypass in Wagtail API v2

#security #cve #cybersecurity #ghsa

GHSA-C2XX-CJMH-9Q8F: Information Disclosure via Inherited Collection View Restriction Bypass in Wagtail API v2

Vulnerability ID: GHSA-C2XX-CJMH-9Q8F
CVSS Score: 5.3
Published: 2026-08-20

An improper access control vulnerability in Wagtail's Documents and Images API V2 allows unauthenticated remote attackers to retrieve metadata (including titles and filenames) of files residing inside descendant collections of private parent collections, bypassing inherited view restrictions.

TL;DR

Unauthenticated users can exploit Wagtail's API V2 to enumerate and leak metadata of protected images and documents by leveraging a logical flaw where descendant collections fail to inherit parent access restrictions during API queries.

Technical Details

  • CWE ID: CWE-200 / CWE-284 / CWE-276
  • Attack Vector: Network
  • CVSS v3.1: 5.3 (Medium)
  • Exploit Status: None / Unproven
  • KEV Status: Not Listed
  • Impact: Information Disclosure (Metadata Leakage)

Affected Systems

  • Wagtail CMS Documents API V2
  • Wagtail CMS Images API V2
  • wagtail: < 7.0.9 (Fixed in: 7.0.9)
  • wagtail: >= 7.1, < 7.3.4 (Fixed in: 7.3.4)
  • wagtail: >= 7.4, < 7.4.3 (Fixed in: 7.4.3)
  • wagtail: >= 8.0rc1, < 8.0rc2 (Fixed in: 8.0rc2)

Mitigation Strategies

  • Upgrade Wagtail to a patched version (7.0.9, 7.3.4, 7.4.3, or 8.0rc2).
  • Implement Django Rest Framework (DRF) permission classes to enforce authentication on the API V2 endpoint.
  • Deploy a Web Application Firewall (WAF) rule to block public access to API endpoints (/api/v2/images/ and /api/v2/documents/).

Remediation Steps:

  1. Verify the current installed version of Wagtail in your environment using the command: pip show wagtail.
  2. Update your package requirements or execute: pip install --upgrade wagtail to apply the corresponding patched version.
  3. If immediate upgrades are impossible, override the default viewsets in api.py and enforce the IsAuthenticated permission class from rest_framework.permissions.
  4. Apply security filters on your reverse proxy or Web Application Firewall (WAF) to restrict external routing to /api/v2/images/ and /api/v2/documents/.

References

Read the full report for GHSA-C2XX-CJMH-9Q8F on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)