CVE-2024-35228Medium· 5.5▾ SunlitImproper Handling of Insufficient Permissions in `wagtail.contrib.settings`
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
0.3% → 0.3%
Last analysed / modified upstream
Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patched versions have been released as Wagtail 6.0.5 and 6.1.2. Wagtail releases prior to 6.0 are unaffected.
No workaround is available.
Many thanks to Victor Miti for reporting this issue.
If you have any questions or comments about this advisory:
wagtail >= 6.0.0, < 6.0.5wagtail >= 6.1.0, < 6.1.2Upgrade to a patched release:
wagtail 6.0.5wagtail 6.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2021-29434Medium· 6.1Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
CVE-2023-28836Medium· 6.4Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
CVE-2023-28837Medium· 4.4Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
CVE-2020-15118Medium· 5.7Cross-Site Scripting in Wagtail
CVE-2026-55468Medium· 4.3Wagtail: Improper restriction handling on Pages admin API
CVE-2026-28222Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes