GHSA-c2xx-cjmh-9q8f

Affected versions of the Wagtail package are vulnerable to Information Disclosure due to improper restriction handling on descendant collections in the Documents and Images API. The API V2 incorrectly lists items in descendants of private collections, failing to enforce the view restrictions defined on their ancestor collections. An attacker with access to the API can exploit this vulnerability to view the filename and name of documents and images in these descendant collections, potentially accessing sensitive information.