### Impact A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. ### Patches Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix. ### Workarounds No workaround is available. ### Acknowledgements Many thanks to Seoyoung Kang @seoyoung-kang from AhnLab and an independent security researcher for reporting this issue. ### For more information If there are any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Send an email to [[email protected]](mailto:[email protected]) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
Update wagtail to 7.0.7; wagtail to 7.3.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanWagtail has improper permission handling when comparing revisions affects wagtail (pip), wagtail (pip). Severity is medium. ### Impact A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. ### Patches Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix. ### Workarounds No workaround is available. ### Acknowledgements Many thanks to Seoyoung Kang @seoyoung-kang from AhnLab and an independent security researcher for reporting this issue. ### For more information If there are any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Send an email to [[email protected]](mailto:[email protected]) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
AI coding agents often install or upgrade packages automatically in pip. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package |
|---|
### Impact A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. ### Patches Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix. ### Workarounds No workaround is available. ### Acknowledgements Many thanks to Seoyoung Kang @seoyoung-kang from AhnLab and an independent security researcher for reporting this issue. ### For more information If there are any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Send an email to [[email protected]](mailto:[email protected]) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
Update wagtail to 7.0.7; wagtail to 7.3.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanWagtail has improper permission handling when comparing revisions affects wagtail (pip), wagtail (pip). Severity is medium. ### Impact A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. ### Patches Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix. ### Workarounds No workaround is available. ### Acknowledgements Many thanks to Seoyoung Kang @seoyoung-kang from AhnLab and an independent security researcher for reporting this issue. ### For more information If there are any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Send an email to [[email protected]](mailto:[email protected]) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).
AI coding agents often install or upgrade packages automatically in pip. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package |
|---|
| Affected range |
|---|
| Fixed version |
|---|
| wagtailpip | <7.0.7 | 7.0.7 |
|---|---|---|
| wagtailpip | >=7.1,<7.3.2 | 7.3.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Affected range |
|---|
| Fixed version |
|---|
| wagtailpip | <7.0.7 | 7.0.7 |
|---|---|---|
| wagtailpip | >=7.1,<7.3.2 | 7.3.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard