CVE-2026-123820
5.3 MEDIUMpublic exploit availablePublished 2026-11-09 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though descendants inherit ancestor view restrictions. An API user can therefore list the filenames and names of documents and images stored in descendant collections that should remain private. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-280
Public exploit & PoC references
- https://github.com/wagtail/wagtail/commit/320c37ed4624702d3864ce2364ce8536b2ce5115
- https://github.com/wagtail/wagtail/commit/9a69e0ad153c515ddd86ddd33d2c9d2554201568
- https://github.com/wagtail/wagtail/commit/b8a2040dfcdb97498b746254ad8bb4e47e21358c
- https://github.com/wagtail/wagtail/commit/cba80389067121c0fae41a3312e2daf76f0eb206
- https://github.com/wagtail/wagtail/releases/tag/v7.0.9
- https://github.com/wagtail/wagtail/releases/tag/v7.3.4
- https://github.com/wagtail/wagtail/releases/tag/v7.4.3
- https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
- https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f
All references
- https://github.com/wagtail/wagtail/commit/320c37ed4624702d3864ce2364ce8536b2ce5115
- https://github.com/wagtail/wagtail/commit/9a69e0ad153c515ddd86ddd33d2c9d2554201568
- https://github.com/wagtail/wagtail/commit/b8a2040dfcdb97498b746254ad8bb4e47e21358c
- https://github.com/wagtail/wagtail/commit/cba80389067121c0fae41a3312e2daf76f0eb206
- https://github.com/wagtail/wagtail/releases/tag/v7.0.9
- https://github.com/wagtail/wagtail/releases/tag/v7.3.4
- https://github.com/wagtail/wagtail/releases/tag/v7.4.3
- https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
- https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-123819PoC
- LOWCVE-2026-125105PoC
- MEDIUMCVE-2026-125106PoC
- MEDIUMCVE-2026-20577
- MEDIUMCVE-2026-20599
- UNSCOREDCVE-2026-21121
- UNSCOREDCVE-2026-3322PoC
- LOWCVE-2026-54471
Related by shared AI tags and CWE weakness class. Browse the full archive.