CVE-2026-44198: Torchbox Wagtail

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Affected products

• Torchbox Wagtail: before 7.0.7 (fixed in 7.0.7); from 7.1, before 7.3.2 (fixed in 7.3.2)

Published 2026-05-11. Last modified 2026-06-17.