PyPI: wagtail
CVE-2026-54261
Safety vulnerability ID: SFTY-20260820-25794
Affected versions of the Wagtail package are vulnerable to Improper Handling of Insufficient Permissions or Privileges due to a missing permission check on the image preview endpoint. The `preview` endpoint fails to verify user permissions, allowing any authenticated user with access to the Wagtail admin to preview images regardless of their specific permissions. An attacker with access to the Wagtail admin can exploit this vulnerability to view any image in the admin interface, although the image object's stored data is not exposed.
Overview
Wagtail: Improper permission handling in image preview
Advisory
wagtail – Improper Handling of Insufficient Permissions or Privileges
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260820-25794/CVE-2026-54261
- https://github.com/wagtail/wagtail/security/advisories/GHSA-r6p4-grq7-xm4m
- https://nvd.nist.gov/vuln/detail/CVE-2026-54261
- https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-614.yaml
- https://github.com/advisories/GHSA-r6p4-grq7-xm4m
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more