CVE-2026-123820— Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Quick assessment

Affected

wagtail wagtail

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wagtail 是一个基于 Django 构建的开源内容管理系统。在版本 7.0.9、7.3.4、7.4.3 和 8.0rc2 之前，Wagtail 的文档与图片 API v2 虽然排除了直接受限的集合，却未能排除其子集合（后代集合），尽管子集合会继承父集合的视图访问限制。因此，API 用户可以列出本应保持私密的子集合中所存储文档和图片的文件名及名称。该问题已在版本 7.0.9、7.3.4、7.4.3 和 8.0rc2 中得到修复。

CVSS 5.3 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1070.001

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Source: CVE Program / CVE List V5

Vulnerability Description

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though descendants inherit ancestor view restrictions. An API user can therefore list the filenames and names of documents and images stored in descendant collections that should remain private. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不充分权限或特权的处理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wagtail	wagtail	< 7.0.9	-

II. Public POCs for CVE-2026-123820

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123820

请登录查看更多情报信息。

Other References for CVE-2026-123820 (9)

https://github.com/wagtail/wagtail/releases/tag/v7.4.3 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v7.0.9 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v7.3.4 x_refsource_MISC
https://github.com/wagtail/wagtail/releases/tag/v8.0rc2 x_refsource_MISC
https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f x_refsource_CONFIRM
https://github.com/wagtail/wagtail/commit/9a69e0ad153c515ddd86ddd33d2c9d2554201568 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/320c37ed4624702d3864ce2364ce8536b2ce5115 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/b8a2040dfcdb97498b746254ad8bb4e47e21358c x_refsource_MISC
https://github.com/wagtail/wagtail/commit/cba80389067121c0fae41a3312e2daf76f0eb206 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-123820

Same Patch Batch · wagtail · 2026-11-09 · 4 CVEs total

CVE-2026-125106	6.5 MEDIUM	Wagtail: Improper restriction handling on Page translation API endpoint
CVE-2026-123819	6.5 MEDIUM	Wagtail: Improper permission handling when copying snippets
CVE-2026-125105	3.7 LOW	Wagtail: Identification of documents by SHA1 hash

IV. Related Vulnerabilities

Same product: wagtail

Same vendor: wagtail

Same weakness: CWE-280