Permission check bypass in Wagtail when editing a model with per-field restrictions
Summary
CVE-2024-32882: Impact If a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more fields... Affects wagtail versions >= 6.0.0, < 6.0.3. Fixed in 6.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) built on Django, designed to create flexible and user-friendly websites. It provides a range of features for managing and editing content, including the ability to define models with per-field restrictions. These restrictions allow administrators to control access to specific fields within a model. However, a vulnerability has been discovered in Wagtail that allows users with edit permission over a model, but not a specific field, to bypass the permission check and update the value of that field.
Vulnerability Detail
The vulnerability arises when a model is made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel is used to restrict access to certain fields. In this scenario, an attacker with edit permission over the model can craft an HTTP POST request that bypasses the permission check on the individual field, enabling them to update its value. This vulnerability does not affect ordinary site visitors or users without edit access to the model. The editing interfaces for pages and snippets are also unaffected.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.3
This is the first release that contains the fix.
pip install --upgrade "wagtail==6.0.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For ModelViewSet, site owners can register the affected model as a snippet instead of using ModelViewSet. This can be done by creating a new model inheriting from wagtail.snippets.models.Snippet and registering it in the admin interface. This will avoid the vulnerability introduced by ModelViewSet. However, there is no workaround available for wagtail.contrib.settings.
Conclusion
The vulnerability in Wagtail that allows permission check bypass when editing a model with per-field restrictions has been addressed in Wagtail 6.0.3 and 6.1. It is crucial to upgrade to the patched versions or apply the recommended workaround to ensure the security of your Wagtail installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wagtail →
FAQ
This vulnerability affects Wagtail versions 6.0.0 to 6.0.2. Wagtail versions prior to 6.0 and versions 6.0.3 and above are not affected.
An attacker with edit permission over a model, but not a specific field, can bypass the permission check and update the value of that field. This could potentially lead to unauthorized modifications of sensitive data.
No, ordinary site visitors without access to the Wagtail admin interface are not able to exploit this vulnerability.
No, the editing interfaces for pages and snippets are not affected by this vulnerability.
To mitigate this vulnerability, it is recommended to upgrade to Wagtail 6.0.3 or 6.1. Alternatively, for ModelViewSet, you can register the affected model as a snippet instead. However, there is no workaround available for wagtail.contrib.settings.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
