CVE-2026-44201

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

• CWE-280

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44196Pingvin Share X is a secure and easy self-hosted file sharin…9.1
• CVE-2026-44197Wagtail is an open source content management system built on…6.5
• CVE-2026-44198Wagtail is an open source content management system built on…4.3
• CVE-2026-44199Wagtail is an open source content management system built on…6.5
• CVE-2026-4420Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in…5.4
• CVE-2026-44200Wagtail is an open source content management system built on…6.5
• CVE-2026-44204Shelf is a platform for tracking physical assets. From 1.12 …6.5
• CVE-2026-44205Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-44206Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-44207Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-44208Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-44209Banks generates meaningful LLM prompts using a template lang…7.5