CVE-2023-45809

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 4.1.8 (LTS), 5.0.5 and 5.1.3. The fix is also included in Release Candidate 1 of the forthcoming Wagtail 5.2 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-200
• CWE-425
• CWE-532

• https://github.com/wagtail/wagtail/commit/bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5bPatch
• https://github.com/wagtail/wagtail/security/advisories/GHSA-fc75-58r8-rm3hVendor Advisory
• https://github.com/wagtail/wagtail/commit/bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5bPatch
• https://github.com/wagtail/wagtail/security/advisories/GHSA-fc75-58r8-rm3hVendor Advisory

Published

Oct 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45803urllib3 is a user-friendly HTTP client library for Python. u…4.2
• CVE-2023-45804Rejected reason: User requested a CVE number by mistake
• CVE-2023-45805pdm is a Python package and dependency manager supporting th…7.8
• CVE-2023-45806Discourse is an open source platform for community discussio…5.4
• CVE-2023-45807OpenSearch is a community-driven, open source fork of Elasti…5.4
• CVE-2023-45808iTop is an IT service management platform. When creating or…5.4
• CVE-2023-4581Excel `.xll` add-in files did not have a blocklist entry in …4.3
• CVE-2023-45810OpenFGA is a flexible authorization/permission engine built …7.5
• CVE-2023-45811Synchrony deobfuscator is a javascript cleaner & deobfuscato…7.8
• CVE-2023-45812The Apollo Router is a configurable, high-performance graph …7.5
• CVE-2023-45813Torbot is an open source tor network intelligence tool. In a…7.5
• CVE-2023-45814Bunkum is an open-source protocol-agnostic request server fo…5.3