CVE-2026-55468

Affected versions of the Wagtail package are vulnerable to Information Disclosure due to improper access control on the Pages admin API. The `PagesAdminAPIViewSet` fails to restrict access to page fields declared in `api_fields`, allowing users with Wagtail admin access to retrieve contents of draft and live page fields, including custom fields. An attacker with admin access can exploit this vulnerability to access sensitive page information that should be restricted, but it is not exploitable by ordinary site visitors without such access.