CVE-2026-123820

MediumCVSS 5.3/10Last modified Nov 10, 2026

Description

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though descendants inherit ancestor view restrictions. An API user can therefore list the filenames and names of documents and images stored in descendant collections that should remain private. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-280

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1238246.3The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external CVE-2026-1238285.9A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an a CVE-2026-1238292.5A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to re CVE-2026-123837.5A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classe CVE-2026-1238319.6In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings CVE-2026-1238329.6In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database CVE-2026-1238333.6In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects CVE-2026-1238347.5In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account CVE-2026-1238355.9In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition CVE-2026-1238368.8In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup CVE-2026-1238377.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WS CVE-2026-1238387.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file