CVE-2026-55468: Medium severity pip/wagtail vulnerability
Impact
The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model (title, slug, seotitle, searchdescription), as well as all custom fields declared in apifields.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
Workarounds
Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:
python wagtailhooks.py or AppConfig.ready()
from wagtail.admin.api.views import PagesAdminAPIViewSet from wagtail.permissions import pagepermissionpolicy
def restrictedgetbasequeryset(self): return pagepermissionpolicy.explorableinstances(self.request.user)
PagesAdminAPIViewSet.getbasequeryset = restrictedgetbasequeryset
Acknowledgements
Many thanks to xuliang@QAX for reporting this issue.
For more information
If you have any questions or comments about this advisory:
- Visit Wagtail's support channels - Email us at security@wagtail.org (view our security policy for more information).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Configuration
For site owners unable to upgrade, patch vulnerable admin API endpoints by overriding the relevant method on `PagesAdminAPIViewSet` (e.g., set `PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset`) so `get_base_queryset` returns `page_permission_policy.explorable_instances(self.request.user)` to ensure access-controlled results for fields in `api_fields`.
Wagtail PagesAdminAPIViewSet (Pages admin API) get_base_queryset override (_restricted_get_base_queryset) = page_permission_policy.explorable_instances(self.request.user)
Event History
Frequently Asked Questions
Who can access the exposed page data?
A user must have access to the Wagtail admin. Ordinary site visitors without Wagtail admin access cannot exploit this issue.
What information could an affected user retrieve?
They can fetch draft and live contents of base page fields declared in api_fields, including title, slug, seo_title, and search_description, plus any custom fields declared in api_fields.
What can be done if upgrading is not immediately possible?
Override PagesAdminAPIViewSet.get_base_queryset to return page_permission_policy.explorable_instances(self.request.user). The supplied workaround should be placed in wagtail_hooks.py or AppConfig.ready() and applies the permission restriction to vulnerable admin API endpoints.
Which releases contain patches?
Patched releases are Wagtail 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.