CVE-2026-55468: 
Python vulnerability analysis and mitigation

CVE-2026-55468 is an improper access control vulnerability in Wagtail's internal Pages admin API that allows authenticated admin users to retrieve page field contents without proper authorization checks. The flaw affects Wagtail versions below 7.0.9, 7.1 through 7.3.3, 7.4 through 7.4.2, and 8.0rc1. It was disclosed on August 20, 2026, with patched versions released simultaneously. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Wagtail Advisory).

The root cause is CWE-280 (Improper Handling of Insufficient Permissions or Privileges): the PagesAdminAPIViewSet.get_base_queryset() method does not apply the page permission policy when building the queryset returned by the admin API, meaning it omits authorization checks entirely. As a result, any authenticated Wagtail admin user can query the internal Pages admin API to retrieve field values — including title, slug, seo_title, search_description, and all custom fields declared in api_fields — for draft and live pages they would not normally have permission to view. Exploitation requires only low-privilege network access (a valid Wagtail admin account) and no special configuration or user interaction (GitHub Advisory, Wagtail Advisory).

Successful exploitation allows an authenticated Wagtail admin user to read the contents of draft and live page fields — including custom fields — that they are not authorized to access under the site's permission model. This represents a confidentiality breach limited to page metadata and custom field data; there is no integrity or availability impact. The vulnerability cannot be exploited by ordinary site visitors without admin access, limiting the attack surface to internal or compromised admin accounts (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available. Exploitation requires a valid Wagtail admin account, significantly reducing the risk to externally exposed instances (GitHub Advisory, Wagtail Advisory).

1. Obtain admin access: Authenticate to the Wagtail admin interface using a valid low-privilege admin account (e.g., an editor with access to only certain page trees).
2. Identify the admin API endpoint: Locate the internal Pages admin API endpoint, typically at /admin/api/main/pages/ on the Wagtail instance.
3. Query restricted pages: Send an authenticated HTTP GET request to the admin API endpoint, optionally filtering by page ID or type, to retrieve page listings including fields declared in api_fields.
4. Extract unauthorized field data: Parse the API response to obtain title, slug, seo_title, search_description, and any custom fields from draft or live pages the user would not normally have permission to view (GitHub Advisory).

• Network: Unusual or repeated HTTP GET requests to /admin/api/main/pages/ from admin accounts that do not normally interact with the API, especially querying page IDs outside their normal scope.
• Logs: Web server or Django access logs showing authenticated requests to the Pages admin API endpoint with query parameters targeting specific page types or IDs by low-privilege admin users.
• Behavioral: Admin accounts querying the API for pages in page trees they are not assigned to manage, or bulk enumeration of page IDs via the admin API.

Wagtail has released patched versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, which apply proper permission checks in get_base_queryset(). Site owners unable to upgrade immediately can apply the following workaround in wagtail_hooks.py or AppConfig.ready():

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy

def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Upgrading to a patched version is the recommended long-term solution (GitHub Advisory, Wagtail Advisory).

The vulnerability was reported by xuliang@QAX and credited to the Wagtail security team members zerolab (remediation developer) and thibaudcolas (remediation reviewer). No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (Wagtail Advisory).