CVE-2026-55468: Wagtail: Improper restriction handling on Pages admin API

The internal Pages admin API incorrectly returns page fields without access control when they are declared in api_fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api_fields on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in api_fields.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.