Wagtail up to 7.3rc1 Preview Endpoint authorization

Summaryinfo

A vulnerability classified as problematic has been found in Wagtail up to 6.3.5/7.0.3/7.1.2/7.2.1/7.3rc1. The affected element is an unknown function of the component Preview Endpoint. Performing a manipulation results in authorization. This vulnerability is reported as CVE-2026-25517. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Wagtail up to 6.3.5/7.0.3/7.1.2/7.2.1/7.3rc1. It has been classified as problematic. This affects some unknown processing of the component Preview Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-25517 since 02/02/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 6.3.6, 7.0.4, 7.1.3 or 7.2.2 eliminates this vulnerability. Applying the patch 01fd3477365a193e6a8270311defb76e890d2719 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-6094). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Wagtail

Version

• 6.3.0
• 6.3.1
• 6.3.2
• 6.3.3
• 6.3.4
• 6.3.5
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.1.0
• 7.1.1
• 7.1.2
• 7.2.0
• 7.2.1
• 7.3rc1

License

• open-source

Website

• Product: https://github.com/wagtail/wagtail/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion