CVE-2026-123820

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though descendants inherit ancestor view restrictions. An API user can therefore list the filenames and names of documents and images stored in descendant collections that should remain private. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

• CWE-280

• https://github.com/wagtail/wagtail/commit/320c37ed4624702d3864ce2364ce8536b2ce5115
• https://github.com/wagtail/wagtail/commit/9a69e0ad153c515ddd86ddd33d2c9d2554201568
• https://github.com/wagtail/wagtail/commit/b8a2040dfcdb97498b746254ad8bb4e47e21358c
• https://github.com/wagtail/wagtail/commit/cba80389067121c0fae41a3312e2daf76f0eb206
• https://github.com/wagtail/wagtail/releases/tag/v7.0.9
• https://github.com/wagtail/wagtail/releases/tag/v7.3.4
• https://github.com/wagtail/wagtail/releases/tag/v7.4.3
• https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
• https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123815pyLoad is a free and open-source download manager written in…9.4
• CVE-2026-123816pyLoad is a free and open-source download manager written in…8.1
• CVE-2026-123817AIOHTTP is an asynchronous HTTP client/server framework for …8.7
• CVE-2026-123818LMDeploy is a toolkit for compressing, deploying, and servin…7.5
• CVE-2026-123819Wagtail is an open source content management system built on…6.5
• CVE-2026-12382A flaw was found in the AAP Gateway Envoy proxy configuratio…8.2
• CVE-2026-123824The Symfony Config component XmlUtils::parse() enables DTD v…6.3
• CVE-2026-123828A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc ha…5.9
• CVE-2026-123829A Permission Model bypass in Node.js recursive file watching…2.5
• CVE-2026-12383A flaw was found in the Event-Driven Ansible (EDA) server. T…7.5
• CVE-2026-123831In JetBrains CLion before 2026.2, 2026.1.4 code execution w…9.6
• CVE-2026-123832In JetBrains CLion before 2026.2 code execution was possible…9.6