CVE-2022-21683

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not have editing access to, as long as they have left a comment or reply somewhere on the site. A patched version has been released as Wagtail 2.15.2, which restores the intended behaviour - to send notifications for new replies to the participants in the active thread only (editing permissions are not considered). New comments can be disabled by setting `WAGTAILADMIN_COMMENTS_ENABLED = False` in the Django settings file.

• CWE-200
• CWE-200

• https://github.com/wagtail/wagtail/commit/5fe901e5d86ed02dbbb63039a897582951266afdPatch, Third Party Advisory
• https://github.com/wagtail/wagtail/releases/tag/v2.15.2Release Notes, Third Party Advisory
• https://github.com/wagtail/wagtail/security/advisories/GHSA-xqxm-2rpm-3889Mitigation, Third Party Advisory
• https://github.com/wagtail/wagtail/commit/5fe901e5d86ed02dbbb63039a897582951266afdPatch, Third Party Advisory
• https://github.com/wagtail/wagtail/releases/tag/v2.15.2Release Notes, Third Party Advisory
• https://github.com/wagtail/wagtail/security/advisories/GHSA-xqxm-2rpm-3889Mitigation, Third Party Advisory

Published

Jan 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21678Discourse is an open source discussion platform. Prior to ve…4.3
• CVE-2022-21679Istio is an open platform to connect, manage, and secure mic…9.8
• CVE-2022-2168The Download Manager WordPress plugin before 3.2.44 does not…6.1
• CVE-2022-21680Marked is a markdown parser and compiler. Prior to version 4…7.5
• CVE-2022-21681Marked is a markdown parser and compiler. Prior to version 4…7.5
• CVE-2022-21682Flatpak is a Linux application sandboxing and distribution f…6.5
• CVE-2022-21684Discourse is an open source discussion platform. Versions pr…8.8
• CVE-2022-21685Frontier is Substrate's Ethereum compatibility layer. Prior …6.5
• CVE-2022-21686PrestaShop is an Open Source e-commerce platform. Starting w…9.8
• CVE-2022-21687gh-ost is a triggerless online schema migration solution for…6.5
• CVE-2022-21688OnionShare is an open source tool that lets you securely and…5.5
• CVE-2022-21689OnionShare is an open source tool that lets you securely and…7.5