CVE-2023-45809: Wagtail Content Management System User Account Information Disclosure
Summary
CVE-2023-45809: Wagtail is an open source content management system built on Django. Affects wagtail across 4 version ranges.
< 4.1.9
>= 4.2, < 5.0.5
>= 5.1, < 5.1.3
< bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5b
Fixed in 4.1.9, 5.0.5 or 5.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open source content management system built on Django. It provides a user-friendly interface for managing website content and allows users to create, edit, and publish content easily. The system is widely used and offers various features such as a customizable admin interface, content versioning, and workflow management. However, a vulnerability has been discovered in Wagtail that allows a user with a limited-permission editor account to disclose user account information.
Vulnerability Detail
The vulnerability in Wagtail allows a user with a limited-permission editor account to make a direct URL request to the admin view that handles bulk actions on user accounts. Although the user is restricted from making any changes, the error message returned by the system discloses the display names of user accounts. By modifying URL parameters, the user can retrieve the display name for any user. This vulnerability does not pose a risk to ordinary site visitors without access to the Wagtail admin. However, it can potentially expose sensitive information about user accounts, which may be used for social engineering or targeted attacks. The vulnerability has been assigned a CVSS score of 2.7, indicating a low severity level.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.1.94.1.9pip install --upgrade "wagtail==4.1.9" -
>= 4.2, < 5.0.55.0.5pip install --upgrade "wagtail==5.0.5" -
>= 5.1, < 5.1.35.1.3pip install --upgrade "wagtail==5.1.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The vulnerability in Wagtail allows a user with a limited-permission editor account to disclose user account information. While no unauthorized changes can be made, this information can be used for malicious purposes. Users are strongly advised to upgrade to the patched versions of Wagtail (4.1.8 LTS, 5.0.5, or 5.1.3) to mitigate the risk. Regularly updating Wagtail and other dependencies is recommended to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wagtail →
FAQ
Wagtail is an open source content management system built on Django. It provides a user-friendly interface for managing website content and offers various features such as a customizable admin interface, content versioning, and workflow management.
Users of Wagtail versions prior to 4.1.8 (LTS), 5.0.5, or 5.1.3 are affected by this vulnerability. Users with limited-permission editor accounts in the Wagtail admin interface are particularly at risk.
The vulnerability allows a user with a limited-permission editor account to retrieve the display names of user accounts. While no unauthorized changes can be made, this information can be used for social engineering or targeted attacks.
No, there are no known workarounds for this vulnerability. Users are advised to upgrade to the patched versions of Wagtail.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Wagtail installation is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
