CVE-2026-54261: Wagtail: Improper permission handling in image preview

August 20, 2026

Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

References

github.com/advisories/GHSA-r6p4-grq7-xm4m
github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-614.yaml
github.com/wagtail/wagtail/security/advisories/GHSA-r6p4-grq7-xm4m
nvd.nist.gov/vuln/detail/CVE-2026-54261

Code Behaviors & Features

Detect and mitigate CVE-2026-54261 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →