Skip to content
Heist/ feed
Back to feed
Medium

Wagtail: Improper permission handling when deleting form submissions

Type: advisorySources: OSV

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-44199
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 08:55 UTC · Revision 1

Source evidence

Wagtail: Improper permission handling when deleting form submissions

core-osv · Original source

Published 11 May 2026, 14:40 UTC

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

osv:CVE-2026-44199
Complete source record
{
  "id": "aa9916e639cdad6ad500343ba9b7ca8ee1a218c78dbbd12a2f751e957b8b26fc",
  "url": "https://osv.dev/vulnerability/CVE-2026-44199",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Wagtail: Improper permission handling when deleting form submissions",
    "summary": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.",
    "evidence": "osv:CVE-2026-44199",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-44199",
      "aliases": [
        "CVE-2026-44199",
        "GHSA-pwm3-7fv4-g6xx",
        "PYSEC-2026-148"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/wagtail/wagtail",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "cb3ed5a2891466f99aa213575caf40ef273a307b"
                },
                {
                  "introduced": "cf8c53ea06a1dea16fee8c2ca1cf76aa37e5e322"
                },
                {
                  "fixed": "e6a58de6d40f3eb7a8a35125a4db04701ab65ba6"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.0.7"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "7.1"
                      },
                      {
                        "fixed": "7.3.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v7.0.6",
            "v7.3.1",
            "v7.0.5",
            "v7.3",
            "v7.0.4",
            "v7.3rc1",
            "v7.0.3",
            "v7.0.2",
            "v7.0.1",
            "v7.0",
            "v7.0rc1",
            "v4.1rc1",
            "v2.16rc1",
            "v2.11.rc1",
            "v2.8rc1",
            "v2.2rc1",
            "v1.10rc1",
            "v1.8rc1",
            "v1.6rc1",
            "v1.5rc1",
            "v1.4rc1",
            "v1.3rc1",
            "v1.2rc1",
            "v1.1rc1",
            "v1.0rc1",
            "v1.0b2",
            "v0.8.1",
            "v0.8",
            "v0.7",
            "v0.6",
            "v0.5",
            "v0.4",
            "v0.2",
            "v0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44199.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:34.196439193Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44199.json",
        "https://github.com/wagtail/wagtail/security/advisories/GHSA-pwm3-7fv4-g6xx",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-44199"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-280"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44199.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-44199",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 501280,
  "published_at": "2026-05-11T14:40:58.488+00:00"
}