Disclosure of user names via admin bulk action views in wagtail

Also known as GHSA-fc75-58r8-rm3h, PYSEC-2023-219

Published 3 y ago 2023-10-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

2.7

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 46%

Public exploits

none known

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 4.1.8 (LTS), 5.0.5 and 5.1.3. The fix is also included in Release Candidate 1 of the forthcoming Wagtail 5.2 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Exploit prediction (EPSS)

0.56% probability of exploitation in the next 30 days, higher than 46% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	2.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N`
CNA	3.1	2.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N`
NVD	3.1	2.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N`
OSV	3.1	2.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N`
GitHub	3.1	2.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`wagtail`	<4.1.9 >=4.2.0, <5.0.5 >=5.1.0, <5.1.3 >=4.2, <5.0.5 >=5.1, <5.1.3	4.1.9 5.0.5 5.1.3

Affected products

wagtail wagtail

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-425 Direct Request
CWE-532 Insertion of Sensitive Information into Log File

References

github.com /wagtail/wagtail/security/advisories/GHSA-fc75-58r8-rm3h · x_refsource_CONFIRM, x_transferred
github.com /wagtail/wagtail/commit/bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5b · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2023-45809 · advisory
github.com /wagtail/wagtail/commit/0bacd29473107d9d7f5b723a15a683449679756d · web
github.com /wagtail/wagtail/commit/2231f462c75dfe84307fb40577e8c2109a23b27e · web
github.com /pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-219.yaml · web
github.com /wagtail/wagtail · package
github.com /wagtail/wagtail/releases/tag/v4.1.9 · web
github.com /wagtail/wagtail/releases/tag/v5.0.5 · web
github.com /wagtail/wagtail/releases/tag/v5.1.3 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary