PT-2026-39235 · Wagtail · Wagtail

Thesanjok · Published 2026-05-08 · Updated 2026-05-11 · CVE-2026-44200

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.7 Wagtail versions prior to 7.3.2

Description Improper permission handling allows a CMS user with limited page access to copy a page they are not authorized to access to a site area where they do have permissions. This enables the user to view the contents of the unauthorized page and potentially publish it, as permissions were verified for the copy destination but not for the source page.

Recommendations Update to version 7.0.7. Update to version 7.3.2. Update to version 7.4 LTS.

Fix

Weakness Enumeration

CWE-280

Related Identifiers

CVE-2026-44200

GHSA-67RV-MG8Q-5PF3

PYSEC-2026-149

Affected Products

Wagtail

References · 9

• https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44200 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67rv-mg8q-5pf3 · Vendor Advisory
• https://github.com/wagtail/wagtail · Note
• https://twitter.com/dailycve/status/2052887703927009585 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053918193601638518 · Twitter Post
• https://twitter.com/infoflowcloud/status/2053933481139294415 · Twitter Post
• https://twitter.com/CVEnew/status/2053932480198221996 · Twitter Post