VULNERABILITY INTELLIGENCE

CVE-2026-44201

CVSS score5.3 MEDIUM

EPSS probability0.26%

CISA KEVNot currently listed

Published2026-05-11

Last modified2026-06-17

Description

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.