PT-2026-6307 · Wagtail · Wagtail

Thxtech · CVE-2026-25517 · Published 2026-02-03 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 6.3.6 Wagtail versions prior to 7.0.4 Wagtail versions prior to 7.1.3 Wagtail versions prior to 7.2.2 Wagtail versions prior to 7.3

Description Wagtail, an open source content management system built on Django, contains an issue due to a missing permission check on the preview endpoints. A user with access to the Wagtail admin and knowledge of a model's fields can construct a form submission to obtain a preview rendering of any page, snippet, or site setting object for which previews are enabled, using data of their choosing. The existing data of the object itself is not exposed, but the rendering process may reveal other database contents accessible only to users with edit access over the model. The issue is not exploitable by ordinary site visitors without Wagtail admin access.

Recommendations Update to Wagtail version 6.3.6 or later. Update to Wagtail version 7.0.4 or later. Update to Wagtail version 7.1.3 or later. Update to Wagtail version 7.2.2 or later. Update to Wagtail version 7.3 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25517

GHSA-4QVV-G3VR-M348

PYSEC-2026-2030

Affected Products

Wagtail

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25517.json · Exploit
• https://github.com/wagtail/wagtail/commit/7dfe8de5f8b3f112c73c87b6729197db16454915 · Patch
• https://github.com/wagtail/wagtail/commit/01fd3477365a193e6a8270311defb76e890d2719 · Patch
• https://github.com/wagtail/wagtail/commit/5f09b6da61e779b0e8499bdbba52bf2f7bd3241f · Patch
• https://github.com/wagtail/wagtail/commit/dd824023a031f1b82a6b6f83a97a5c73391b7c03 · Patch
• https://github.com/wagtail/wagtail/security/advisories/GHSA-4qvv-g3vr-m348 · Vendor Advisory
• https://github.com/wagtail/wagtail/commit/73f070dbefbd3b39ea6649ce36bd2d2a6eef2190 · Patch
• https://osv.dev/vulnerability/CVE-2026-25517 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4qvv-g3vr-m348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25517 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2030 · Vendor Advisory
• https://github.com/wagtail/wagtail/releases/tag/v7.2.2 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.1.3 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.3 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.0.4 · Note