ByteOS Network

CVE Vulnerability Details :

CVE-2026-44201

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-11 May, 2026 | 14:42

Updated At-12 May, 2026 | 13:45

▼CVE Numbering Authority (CNA)

Wagtail: Improper restriction handling on Documents and Images API

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Affected Products

Vendor

wagtail

Product

wagtail

Versions

Affected

< 7.0.7
>= 7.1, < 7.3.2

Problem Types

Type	CWE ID	Description
CWE	CWE-280	CWE-280: Improper Handling of Insufficient Permissions or Privileges

Type: CWE

CWE ID: CWE-280

Description: CWE-280: Improper Handling of Insufficient Permissions or Privileges

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Hyperlink	Resource
https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6	x_refsource_CONFIRM

Hyperlink: https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References