CVE-2026-44197

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44197", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T15:13:47.570Z", "datePublished": "2026-05-11T14:39:25.356Z", "dateUpdated": "2026-05-14T17:53:17.749Z"}, "containers": {"cna": {"title": "Wagtail: Improper permission handling when comparing revisions", "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "lang": "en", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj"}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"version": "< 7.0.7", "status": "affected"}, {"version": ">= 7.1, < 7.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T14:39:25.356Z"}, "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4."}], "source": {"advisory": "GHSA-c6wj-9vcj-75pj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T17:52:47.683762Z", "id": "CVE-2026-44197", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T17:53:17.749Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44197", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T17:52:47.683762Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T17:52:50.688Z"}}], "cna": {"title": "Wagtail: Improper permission handling when comparing revisions", "source": {"advisory": "GHSA-c6wj-9vcj-75pj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"status": "affected", "version": "< 7.0.7"}, {"status": "affected", "version": ">= 7.1, < 7.3.2"}]}], "references": [{"url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj", "name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-280", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T14:39:25.356Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44197", "state": "PUBLISHED", "dateUpdated": "2026-05-14T17:53:17.749Z", "dateReserved": "2026-05-05T15:13:47.570Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-11T14:39:25.356Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wagtail", "vendor": "wagtail", "versions": [{"status": "affected", "version": "< 7.0.7"}, {"status": "affected", "version": ">= 7.1, < 7.3.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA54A323-7F77-4D1D-9830-BF8FBE4B5B34", "versionEndExcluding": "7.0.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "FED1A6D7-1193-485D-B25F-60FCC20A6D6B", "versionEndExcluding": "7.3.2", "versionStartIncluding": "7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4."}, {"lang": "es", "value": "Wagtail es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto construido sobre Django. Antes de 7.0.7, 7.3.2 y 7.4, un usuario del CMS sin la capacidad de editar una p\u00e1gina pod\u00eda acceder a las revisiones de la p\u00e1gina a trav\u00e9s de la vista de comparaci\u00f3n de revisiones si conoc\u00eda la clave primaria de dos revisiones. Esto podr\u00eda resultar potencialmente en la divulgaci\u00f3n de informaci\u00f3n sensible. Esta vulnerabilidad est\u00e1 corregida en 7.0.7, 7.3.2 y 7.4."}], "id": "CVE-2026-44197", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44197", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T17:52:47.683762Z", "version": "2.0.3"}}]}, "published": "2026-05-11T16:17:34.823", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-280"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1,7.3.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wagtail", "source": "cna", "vendor": "wagtail"}, "product": "wagtail", "vendor": "wagtail"}], "created": "2026-05-11T17:00:13.733962+00:00", "updated": "2026-05-11T17:00:15.795614+00:00", "vendors": ["wagtail", "wagtail$PRODUCT$wagtail"]}