CVE-2026-25517: Wagtail Improper Permission Handling on Admin Preview Endpoints

wagtail Updated 03 Feb 2026

Summary

03/02/2026

Disclosed on

CVE-2026-25517

CVE

Yes i

Fix available

Moderate

Severity

5.1

CVSS Score

CVE-2026-25517: Wagtail has improper permission handling on admin preview endpoints. Affects wagtail across 5 version ranges.

< 6.3.6 >= 6.4rc1, < 7.0.4 >= 7.1rc1, < 7.1.3 >= 7.2rc1, < 7.2.2 >= 7.3rc1, < 7.3

Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Wagtail is an open-source content management system (CMS) built on Django, designed for managing and publishing content on websites. It offers a user-friendly interface, flexible page structures, and a robust admin panel. However, it has been identified that Wagtail has a vulnerability related to improper permission handling on its admin preview endpoints, which could potentially expose sensitive data.

Vulnerability Detail

The vulnerability arises from a missing permission check on the preview endpoints within Wagtail's admin interface. This allows a user with access to the Wagtail admin to craft a form submission that can obtain a preview rendering of any page, snippet, or site setting object for which previews are enabled. While the existing data of the object itself is not exposed, the rendered template may inadvertently reveal other database contents that should only be accessible to users with edit permissions. This vulnerability is not exploitable by ordinary site visitors without admin access.

How To Fix

Latest published version: 8.0.1 as of 23 Oct 2026

pip install --upgrade "wagtail==8.0.1"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 6.3.6 6.3.6
```
pip install --upgrade "wagtail==6.3.6"
```
>= 6.4rc1, < 7.0.4 7.0.4
```
pip install --upgrade "wagtail==7.0.4"
```
>= 7.1rc1, < 7.1.3 7.1.3
```
pip install --upgrade "wagtail==7.1.3"
```
>= 7.2rc1, < 7.2.2 7.2.2
```
pip install --upgrade "wagtail==7.2.2"
```
>= 7.3rc1, < 7.3 7.3
```
pip install --upgrade "wagtail==7.3"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

No workaround is available for this vulnerability. The only solution is to update to the patched versions mentioned above.

Conclusion

In summary, CVE-2026-25517 is a significant vulnerability in Wagtail that can lead to unauthorized data exposure through improper permission handling on admin preview endpoints. Users are strongly advised to update to the latest patched versions to mitigate this risk.

See every vulnerability recorded for wagtail →

FAQ

What is CVE-2026-25517?

CVE-2026-25517 is a vulnerability in Wagtail that involves improper permission handling on admin preview endpoints, potentially allowing unauthorized data exposure.

Who is affected by this vulnerability?

Any user with access to the Wagtail admin interface could potentially exploit this vulnerability if they know the model's fields.

How can I check if my application is affected?

You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.

What should I do if I cannot update Wagtail immediately?

Unfortunately, there are no workarounds available for this vulnerability. It is crucial to update to a patched version as soon as possible.

What is the CVSS score for this vulnerability?

The CVSS score for this vulnerability is 5.1, indicating a moderate severity level.

References

Related vulnerabilities

Recent vulnerabilities recorded for wagtail.

View all wagtail vulnerabilities →

How To Fix

Latest published version: 8.0.1 as of 23 Oct 2026

pip install --upgrade "wagtail==8.0.1"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 6.3.6 6.3.6
```
pip install --upgrade "wagtail==6.3.6"
```
>= 6.4rc1, < 7.0.4 7.0.4
```
pip install --upgrade "wagtail==7.0.4"
```
>= 7.1rc1, < 7.1.3 7.1.3
```
pip install --upgrade "wagtail==7.1.3"
```
>= 7.2rc1, < 7.2.2 7.2.2
```
pip install --upgrade "wagtail==7.2.2"
```
>= 7.3rc1, < 7.3 7.3
```
pip install --upgrade "wagtail==7.3"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →