CVE-2026-54259: Wagtail Information Disclosure in Documents and Images Chooser

Technical summary

The vulnerability exists in the 'chosen endpoint' of Wagtail's Documents and Images chooser UI components. The endpoint implements insufficient permission checks before populating the list of available items for selection. Specifically, it fails to validate whether the requesting user holds 'choose' permissions for items in each collection before including them in the response. This results in a CVSS 3.1 score of 4.3 (MEDIUM severity: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting that the attack requires network access with low privilege (authenticated staff) and no user interaction, but causes only a limited confidentiality breach without integrity or availability impact. The underlying root cause is improper authorization logic mapped to CWE-280 (Improper Handling of Insufficient Permissions or Privileges).

Business impact

The primary business impact is unauthorized disclosure of asset metadata (filenames, names, URLs) to internal staff members who should not have visibility. In organizations using Wagtail to manage sensitive or confidential document collections, this creates a compliance and privacy risk—for example, staff in one department may glimpse URLs or names of documents assigned to another department or to restricted collections. While the attack surface is limited to authenticated users, the uncontrolled information leakage could violate access control policies and regulatory requirements around data minimization. For public-facing sites with strict content segregation, this undermines the intended permission model and could enable staff to discover or enumerate resources they should not know about.

Affected systems

Wagtail versions prior to 7.0.8, 7.3.3, and 7.4.2 are affected. This covers all three active maintenance branches: the 7.0.x series (patch 7.0.8 and later), the 7.3.x series (patch 7.3.3 and later), and the 7.4.x series (patch 7.4.2 and later). End-of-life versions earlier than 7.0 receive no fixes. The vulnerability is specific to Wagtail's admin interface and does not affect Wagtail-powered public websites unless staff members with admin credentials are compromised or act maliciously.

Exploitability

Exploitability is constrained by the requirement for valid Wagtail admin credentials. An attacker cannot trigger this vulnerability by submitting a crafted request from the public internet; they must already possess authenticated access to the Wagtail admin panel. No user interaction, specific configuration, or exploit code is required once authenticated—the permission logic flaw is triggered during normal use of the Documents or Images chooser UI. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no public, weaponized exploits or in-the-wild abuse has been reported as of the intelligence publication date.

Remediation

Upgrade to patched versions immediately: Wagtail 7.0.8 or later for the 7.0.x branch, 7.3.3 or later for 7.3.x, or 7.4.2 or later for 7.4.x. These versions restore proper permission validation in the Documents and Images chooser endpoints. Verify the installed version via 'pip show wagtail' or check the admin interface's footer or documentation link. Users on end-of-life versions should plan an upgrade to a supported branch.

Patch guidance

Patches are available across all three active maintenance branches with no breaking changes expected. Review the Wagtail release notes for 7.0.8, 7.3.3, and 7.4.2 on the official GitHub repository to confirm compatibility with your deployment. Apply the patch during a maintenance window or immediately if your staff-to-content permission model is sensitive. Verify the upgrade by checking the version number post-deployment and by spot-checking that non-permissioned staff can no longer see items in restricted collections within the chooser interface.

Detection guidance

Monitor Wagtail admin access logs and audit trails for staff users querying the Documents or Images chooser endpoints, particularly in versions prior to the patch. Examine server logs for requests to '/admin/documents/chosen/' and '/admin/images/chosen/' endpoints—if your application uses custom permission logic, log successful and failed authorization checks. Conduct a manual review of staff roles and permissions to identify which users should and should not see certain collections, then verify that the chooser UI respects those boundaries. After patching, spot-test with a low-privilege admin account to confirm restricted collections are no longer visible in the chooser.

Why prioritize this

This vulnerability warrants prompt but not emergency patching. The MEDIUM severity score and restricted attack surface (authenticated admins only) mean it is lower priority than critical remote-code-execution flaws, but it should be addressed before any broader admin access is granted or before managing highly sensitive documents. Organizations where admin-level staff are trusted and turnover is low may deprioritize this slightly; those with many contractors, shared admin accounts, or regulatory restrictions on information access should patch sooner. The lack of KEV designation suggests public exploitation is not yet observed, reducing urgency.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a MEDIUM-severity information disclosure with low complexity. The score accounts for: (1) network accessibility requiring no special network conditions; (2) low privilege threshold (admin/staff login); (3) no user interaction needed; (4) limited scope (only the Documents/Images chooser, not the entire application); and (5) low confidentiality impact (metadata exposure, not bulk data theft). Integrity and availability are unaffected. The score does not capture business context—organizations with strict permission boundaries and sensitive assets may view this as higher risk than the base score suggests.

Frequently asked questions