CVE-2026-44201General(torchbox / wagtail)

LOWCVSS 5.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch torchbox wagtail systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

torchbox CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6

Weakness type (CWE)

CWE-280

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wagtail

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked at 3 mentions on most recent observed day (2026-05-11)
4 total mentions across 2 days

Affected systems

Vendors

torchbox

Products

wagtail

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

General

250.0%

Disclosure

125.0%

Patch

125.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-08	1	General1
2026-05-11	3	Disclosure1General1Patch1

Full discourse4 posts

Infoflowcloud@infoflowcloud149d
Disclosure
🚨*CVE* CVE-2026-44201 Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private … https://www.cve.org/CVERecord?id=CVE-2026-44201 ----- Traducción: CVE-2026-44201 Wag… http://infoflow.cloud`
Post summary
The tweet provides basic disclosure of CVE‑2026‑44201, noting a bug where private items are incorrectly listed, but contains no PoC, exploit code, or patch details.
0000030
77 followersView on X
CVE@CVEnew149d
Patch
CVE-2026-44201 Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private … https://www.cve.org/CVERecord?id=CVE-2026-44201
Post summary
CVE-2026-44201 describes a private item listing flaw in Wagtail that is fixed in versions 7.0.7, 7.3.2, and 7.4; no PoC, exploit, or active use has been reported.
00000120
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds149d
General
CVE-2026-44201 Information Disclosure in Wagtail Documents and Images API Privat... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44201 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces CVE-2026-44201 and directs readers to a vulnerability details page and alert service, but it contains no technical, exploit, or patch information.
0000037
4.0K followersView on X
DailyCVE@dailycve152d
General
🟠 Wagtail, Improper Restriction Handling, #CVE-2026-44201 (Medium) https://dailycve.com/wagtail-improper-restriction-handling-cve-2026-44201-medium/
Post summary
A concise notice of CVE-2026-44201 in Wagtail, highlighting an Improper Restriction Handling flaw rated as medium severity, with no additional details on PoC, exploitation, patching, or validation status.
0000027
198 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	torchbox	wagtail	-	-	-

Explore more

Back to dashboard torchbox CVEs wagtail vulnerabilities

What researchers are saying

CVE-2026-44201

Infoflowcloud@infoflowcloudDisclosure

The tweet provides basic disclosure of CVE‑2026‑44201, noting a bug where private items are incorrectly listed, but contains no PoC, exploit code, or patch details.

CVE@CVEnewPatch

CVE-2026-44201 describes a private item listing flaw in Wagtail that is fixed in versions 7.0.7, 7.3.2, and 7.4; no PoC, exploit, or active use has been reported.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The tweet announces CVE-2026-44201 and directs readers to a vulnerability details page and alert service, but it contains no technical, exploit, or patch information.

DailyCVE@dailycveGeneral

A concise notice of CVE-2026-44201 in Wagtail, highlighting an Improper Restriction Handling flaw rated as medium severity, with no additional details on PoC, exploitation, patching, or validation status.