Jams2

**Name of the Vulnerable Software and Affected Versions** Wagtail versions prior to 6.0.3 and 6.1 **Description** In affected versions, if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This issue is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. **Recommendations** For versions prior to 6.0.3 and 6.1, upgrade to a patched version. As a temporary workaround, for models registered through `ModelViewSet`, register the model as a snippet instead. For settings models, place the restricted fields in a separate settings model, and configure permission at the model level.