CVE-2026-54259

Affected versions of the Wagtail package are vulnerable to Improper Handling of Insufficient Permissions or Privileges due to improper restriction handling on the Documents and Images chooser's chosen endpoints. The endpoints incorrectly list items for which users lack the necessary choose permission, revealing filenames, names, and URLs of documents and images. An attacker with access to the Wagtail admin interface can exploit this vulnerability to view restricted metadata for documents and images without proper authorization.