Update dependency wagtail to v7.0.9 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
wagtail (changelog)	==7.0.8 → ==7.0.9

---

Wagtail: Improper restriction handling on Pages admin API

CVE-2026-55468 / GHSA-3vrh-m9w7-v94f

More information

Details

Impact

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

##### wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy

def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Acknowledgements

Many thanks to xuliang@QAX for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f
• https://github.com/advisories/GHSA-3vrh-m9w7-v94f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Identification of documents by SHA1 hash

GHSA-92hv-j533-69wc

More information

Details

Impact

By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library.

This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners who are unable to upgrade can strip If-Match and If-None-Match from anonymous requests to /documents/ at the reverse proxy, or use a custom document model without a file_hash attribute.

Acknowledgements

Many thanks to Anand Himanshu for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-92hv-j533-69wc
• https://github.com/advisories/GHSA-92hv-j533-69wc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

GHSA-c2xx-cjmh-9q8f

More information

Details

Impact

The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs.

Acknowledgements

Many thanks to Ta Duc Thien for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f
• https://github.com/advisories/GHSA-c2xx-cjmh-9q8f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Improper permission handling when copying snippets

GHSA-x5cx-w6p2-mxf2

More information

Details

Impact

A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

N/A

Acknowledgements

Many thanks to tinyb0y for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2
• https://github.com/advisories/GHSA-x5cx-w6p2-mxf2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Improper restriction handling on Page translation API endpoint

GHSA-jm5p-837g-rv8g

More information

Details

Impact

A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

N/A

Acknowledgements

Many thanks to tinyb0y for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g
• https://github.com/advisories/GHSA-jm5p-837g-rv8g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Improper restriction handling on Pages admin API

CVE-2026-55468 / GHSA-3vrh-m9w7-v94f

More information

Details

Impact

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:

##### wagtail_hooks.py or AppConfig.ready()

from wagtail.admin.api.views import PagesAdminAPIViewSet
from wagtail.permissions import page_permission_policy

def _restricted_get_base_queryset(self):
    return page_permission_policy.explorable_instances(self.request.user)

PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset

Acknowledgements

Many thanks to xuliang@QAX for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Identification of documents by SHA1 hash

GHSA-92hv-j533-69wc

More information

Details

Impact

By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library.

This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners who are unable to upgrade can strip If-Match and If-None-Match from anonymous requests to /documents/ at the reverse proxy, or use a custom document model without a file_hash attribute.

Acknowledgements

Many thanks to Anand Himanshu for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-92hv-j533-69wc
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

GHSA-c2xx-cjmh-9q8f

More information

Details

Impact

The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

Site owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs.

Acknowledgements

Many thanks to Ta Duc Thien for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Improper restriction handling on Page translation API endpoint

GHSA-jm5p-837g-rv8g

More information

Details

Impact

A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

N/A

Acknowledgements

Many thanks to tinyb0y for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail: Improper permission handling when copying snippets

GHSA-x5cx-w6p2-mxf2

More information

Details

Impact

A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.

Patches

Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.

Workarounds

N/A

Acknowledgements

Many thanks to tinyb0y for reporting this issue.

For more information

If you have any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email us at security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

wagtail/wagtail (wagtail)

v7.0.9: 7.0.9

Compare Source

• Security fix: Improper restriction handling on Pages admin API (xuliang@​QAX, Dan Braghis)
• Security fix: Identification of documents by SHA1 hash (Anand Himanshu, Matt Westcott)
• Security fix: Improper restriction handling on descendant collections in Documents and Images API (Ta Duc Thien, Matt Westcott)
• Security fix: Improper permission handling when copying snippets (tinyb0y, Matt Westcott)
• Security fix: Improper restriction handling on Page translation API endpoint (tinyb0y, Matt Westcott)
• Maintenance: Update base managers for Page and Collection to avoid warnings from django-treebeard 5.3 (Samir Shah)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.