CVE-2026-44199— Wagtail 安全漏洞

Wagtail: Improper permission handling when deleting form submissions

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

不充分权限或特权的处理不恰当

Wagtail 安全漏洞

Wagtail是Wagtail开源的一套开源的内容管理系统（CMS）。 Wagtail 7.0.7之前版本、7.3.2之前版本和7.4之前版本存在安全漏洞，该漏洞源于CMS用户可通过构造表单提交删除无权访问的表单页面提交内容，可能导致权限绕过。

N/A

N/A