Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wagtail | pip | < 7.0.7 | 7.0.7 |
| wagtail | pip | >= 7.1, < 7.3.2 | 7.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability in Wagtail allowed a CMS user to access the history of a page even if they did not have editing permissions for it. This could lead to the disclosure of sensitive information. The analysis of the security patches revealed that the issue stemmed from missing permission checks in two key views related to page history and revisions.
The primary vulnerable function identified is PageHistoryView.get_object in wagtail/admin/views/pages/history.py. Before the patch, this function would retrieve and return a page object without validating the user's permissions. The fix, introduced in commit 585cb020a53f59bacf6a7e30fe5f49a90ef77a69, adds an explicit check to ensure the user has either can_publish or can_edit permissions on the page before allowing them to view its history.
A related vulnerable function, RevisionsCompareView.get_object in wagtail/admin/views/pages/revisions.py, was also identified. This function is used when comparing different revisions of a page. Similar to the history view, it lacked a permission check. The patch, from commit 89d390dac28decd71b3a786e64015b963bf3ded4, introduced a check to ensure the user has can_edit permission.
By identifying these two functions, we can conclude that any runtime profiling during the exploitation of this vulnerability would show calls to PageHistoryView.get_object and RevisionsCompareView.get_object as key indicators of the vulnerable activity.
