{"items":[{"id":"NVI-00016415","kind":"vulnerability","title":"Wagtail: Improper permission handling in image preview","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-r6p4-grq7-xm4m","CVE-2026-54261"],"plain_summary":"GitHub lists this reviewed advisory for wagtail, wagtail, wagtail. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0e4ae944139be797d5c73d38235b2422"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-20T18:40:20.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6f04d8ea76244daeb48dad6c2ed880b9"},{"kind":"CVSS","as_of":"2026-07-02T19:25:27.070Z","value":"6.5 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-0e4ae944139be797d5c73d38235b2422"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6f04d8ea76244daeb48dad6c2ed880b9","url":"https://github.com/advisories/GHSA-r6p4-grq7-xm4m","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r6p4-grq7-xm4m","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:14:33.912Z"},{"id":"sr-0e4ae944139be797d5c73d38235b2422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54261","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-54261","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:12.360Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6f04d8ea76244daeb48dad6c2ed880b9"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.\n\n### Workarounds\nFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to `urls.py` URL pattern declarations to override the vulnerable view.\n\n```python\nfrom django.core.exceptions import PermissionDenied\nfrom django.shortcuts import get_object_or_404\nfrom django.urls import path\nfrom wagtail.admin import urls as wagtailadmin_urls\nfrom wagtail.images.permissions import permission_policy\nfrom wagtail.images.views import preview\n\n\ndef patched_preview(request, image_id, filter_spec):\n    image = get_object_or_404(get_image_model(), id=image_id)\n\n    if not permission_policy.user_has_permission_for_instance(request.user, \"change\", image):\n        raise PermissionDenied\n\n    return preview(request, image_id, filter_spec)\n\n\nurlpatterns ","public_affected_ranges":["< 7.0.8"]},{"certainty":"source_listed","source_ids":["sr-6f04d8ea76244daeb48dad6c2ed880b9"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.\n\n### Workarounds\nFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to `urls.py` URL pattern declarations to override the vulnerable view.\n\n```python\nfrom django.core.exceptions import PermissionDenied\nfrom django.shortcuts import get_object_or_404\nfrom django.urls import path\nfrom wagtail.admin import urls as wagtailadmin_urls\nfrom wagtail.images.permissions import permission_policy\nfrom wagtail.images.views import preview\n\n\ndef patched_preview(request, image_id, filter_spec):\n    image = get_object_or_404(get_image_model(), id=image_id)\n\n    if not permission_policy.user_has_permission_for_instance(request.user, \"change\", image):\n        raise PermissionDenied\n\n    return preview(request, image_id, filter_spec)\n\n\nurlpatterns ","public_affected_ranges":[">= 7.1, < 7.3.3"]},{"certainty":"source_listed","source_ids":["sr-6f04d8ea76244daeb48dad6c2ed880b9"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.\n\n### Workarounds\nFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to `urls.py` URL pattern declarations to override the vulnerable view.\n\n```python\nfrom django.core.exceptions import PermissionDenied\nfrom django.shortcuts import get_object_or_404\nfrom django.urls import path\nfrom wagtail.admin import urls as wagtailadmin_urls\nfrom wagtail.images.permissions import permission_policy\nfrom wagtail.images.views import preview\n\n\ndef patched_preview(request, image_id, filter_spec):\n    image = get_object_or_404(get_image_model(), id=image_id)\n\n    if not permission_policy.user_has_permission_for_instance(request.user, \"change\", image):\n        raise PermissionDenied\n\n    return preview(request, image_id, filter_spec)\n\n\nurlpatterns ","public_affected_ranges":[">= 7.4, < 7.4.2"]}],"null_published_at":"2026-11-08T19:53:44.024Z","source_updated_at":"2026-08-20T18:40:20.000Z","source_disclosed_at":"2026-08-20T18:40:18.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T20:14:33.912Z"},{"id":"NVI-00016415","kind":"vulnerability","title":"Wagtail: Improper permission handling in image preview","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-r6p4-grq7-xm4m","CVE-2026-54261"],"plain_summary":"GitHub lists this reviewed advisory for wagtail, wagtail, wagtail. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6f04d8ea76244daeb48dad6c2ed880b9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-20T18:40:20.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6f04d8ea76244daeb48dad6c2ed880b9"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6f04d8ea76244daeb48dad6c2ed880b9","url":"https://github.com/advisories/GHSA-r6p4-grq7-xm4m","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r6p4-grq7-xm4m","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:14:33.912Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6f04d8ea76244daeb48dad6c2ed880b9"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.\n\n### Workarounds\nFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to `urls.py` URL pattern declarations to override the vulnerable view.\n\n```python\nfrom django.core.exceptions import PermissionDenied\nfrom django.shortcuts import get_object_or_404\nfrom django.urls import path\nfrom wagtail.admin import urls as wagtailadmin_urls\nfrom wagtail.images.permissions import permission_policy\nfrom wagtail.images.views import preview\n\n\ndef patched_preview(request, image_id, filter_spec):\n    image = get_object_or_404(get_image_model(), id=image_id)\n\n    if not permission_policy.user_has_permission_for_instance(request.user, \"change\", image):\n        raise PermissionDenied\n\n    return preview(request, image_id, filter_spec)\n\n\nurlpatterns ","public_affected_ranges":["< 7.0.8"]},{"certainty":"source_listed","source_ids":["sr-6f04d8ea76244daeb48dad6c2ed880b9"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.\n\n### Workarounds\nFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to `urls.py` URL pattern declarations to override the vulnerable view.\n\n```python\nfrom django.core.exceptions import PermissionDenied\nfrom django.shortcuts import get_object_or_404\nfrom django.urls import path\nfrom wagtail.admin import urls as wagtailadmin_urls\nfrom wagtail.images.permissions import permission_policy\nfrom wagtail.images.views import preview\n\n\ndef patched_preview(request, image_id, filter_spec):\n    image = get_object_or_404(get_image_model(), id=image_id)\n\n    if not permission_policy.user_has_permission_for_instance(request.user, \"change\", image):\n        raise PermissionDenied\n\n    return preview(request, image_id, filter_spec)\n\n\nurlpatterns ","public_affected_ranges":[">= 7.1, < 7.3.3"]},{"certainty":"source_listed","source_ids":["sr-6f04d8ea76244daeb48dad6c2ed880b9"],"technology":"wagtail","known_exclusions":[],"conditions_summary":"### Impact\nDue to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.\n\n### Workarounds\nFor sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to `urls.py` URL pattern declarations to override the vulnerable view.\n\n```python\nfrom django.core.exceptions import PermissionDenied\nfrom django.shortcuts import get_object_or_404\nfrom django.urls import path\nfrom wagtail.admin import urls as wagtailadmin_urls\nfrom wagtail.images.permissions import permission_policy\nfrom wagtail.images.views import preview\n\n\ndef patched_preview(request, image_id, filter_spec):\n    image = get_object_or_404(get_image_model(), id=image_id)\n\n    if not permission_policy.user_has_permission_for_instance(request.user, \"change\", image):\n        raise PermissionDenied\n\n    return preview(request, image_id, filter_spec)\n\n\nurlpatterns ","public_affected_ranges":[">= 7.4, < 7.4.2"]}],"null_published_at":"2026-11-04T10:04:27.942Z","source_updated_at":"2026-08-20T18:40:20.000Z","source_disclosed_at":"2026-08-20T18:40:18.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:14:33.912Z"}],"next_cursor":null,"snapshot_revision":"42594"}