GHSA-92hv-j533-69wc

Affected versions of the Wagtail package are vulnerable to Information Disclosure due to improper handling of HTTP headers. The `/documents/` endpoint allows attackers to determine the presence of a document by matching a given SHA1 hash through the manipulation of `If-Match` and `If-None-Match` headers, bypassing permission restrictions. An attacker can exploit this by sending crafted requests to ascertain the existence of documents with known SHA1 hashes in the Wagtail document library, potentially revealing sensitive information about document presence.