Suggestions search

Untriaged

Filter by:

With package: python313Packages.wagtail-modeladmin

Found 3 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-55468

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 weeks ago Activity log

Created suggestion 3 weeks ago

Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

References

https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f x_refsource_CONFIRM
https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/d99d2bec2b0aca46d88014416432c717240cd559 x_refsource_MISC
https://github.com/wagtail/wagtail/commit/e2fa629b7a51ec29d59e45eead930feee0d3c4b3 x_refsource_MISC

Affected products

wagtail

==>= 7.4, < 7.4.3
==>= 7.1, < 7.3.4
==>= 8.0rc1, < 8.0rc2
==< 7.0.9

Matching in nixpkgs

pkgs.python313Packages.wagtail

Django content management system focused on flexibility and user experience

nixos-unstable 7.4.1
- nixpkgs-unstable 7.4.2
- nixos-unstable-small 7.4.2
nixos-26.05 7.4.1
- nixos-26.05-small 7.4.1
- nixpkgs-26.05-darwin 7.4.1

pkgs.python314Packages.wagtail

Django content management system focused on flexibility and user experience

nixos-unstable 7.4.1
- nixpkgs-unstable 7.4.2
- nixos-unstable-small 7.4.2
nixos-26.05 7.4.1
- nixos-26.05-small 7.4.1
- nixpkgs-26.05-darwin 7.4.1

pkgs.python313Packages.wagtail-localize

Translation plugin for Wagtail CMS

nixos-unstable 1.13.1
- nixpkgs-unstable 1.13.1
- nixos-unstable-small 1.14.5
nixos-26.05 1.13.1
- nixos-26.05-small 1.13.1
- nixpkgs-26.05-darwin 1.13.1

pkgs.python314Packages.wagtail-localize

Translation plugin for Wagtail CMS

nixos-unstable 1.13.1
- nixpkgs-unstable 1.13.1
- nixos-unstable-small 1.14.5
nixos-26.05 1.13.1
- nixos-26.05-small 1.13.1
- nixpkgs-26.05-darwin 1.13.1

pkgs.python313Packages.wagtail-factories

Factory boy classes for wagtail

nixos-unstable 4.5.0
- nixpkgs-unstable 4.5.0
- nixos-unstable-small 4.5.0
nixos-26.05 4.4.0
- nixos-26.05-small 4.4.0
- nixpkgs-26.05-darwin 4.4.0

pkgs.python314Packages.wagtail-factories

Factory boy classes for wagtail

nixos-unstable 4.5.0
- nixpkgs-unstable 4.5.0
- nixos-unstable-small 4.5.0
nixos-26.05 4.4.0
- nixos-26.05-small 4.4.0
- nixpkgs-26.05-darwin 4.4.0

pkgs.python313Packages.wagtail-modeladmin

Add any model in your project to the Wagtail admin. Formerly wagtail.contrib.modeladmin

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.python314Packages.wagtail-modeladmin

Add any model in your project to the Wagtail admin. Formerly wagtail.contrib.modeladmin

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

Package maintainers

@sephii Sylvain Fankhauser <sephi@fhtagn.top>

Permalink CVE-2026-77036

2.1 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 3 weeks, 4 days ago Activity log

Created suggestion 3 weeks, 4 days ago

elunez eladmin GenConfigController improper authorization

A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

References

VDB-393643 | elunez eladmin GenConfigController improper authorization technical-descriptionvdb-entry
VDB-393643 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
CVE-2026-77036 | CVE Analysis and Report third-party-advisory
Submit #880860 | elunez eladmin 2.7 Improper Authorization third-party-advisory
https://github.com/elunez/eladmin/issues/903 issue-trackingexploit
https://github.com/elunez/eladmin/ product

Affected products

eladmin

==2.4
==2.0
==2.5
==2.1
==2.3
==2.6
==2.2
==2.7

Matching in nixpkgs

pkgs.python313Packages.wagtail-modeladmin

Add any model in your project to the Wagtail admin. Formerly wagtail.contrib.modeladmin

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

pkgs.python314Packages.wagtail-modeladmin

Add any model in your project to the Wagtail admin. Formerly wagtail.contrib.modeladmin

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.3.0
- nixos-26.05-small 2.3.0
- nixpkgs-26.05-darwin 2.3.0

Package maintainers

@sephii Sylvain Fankhauser <sephi@fhtagn.top>

Permalink CVE-2026-8127

2.1 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 4 months ago Activity log

Created suggestion 4 months ago

eladmin Users API Endpoint UserController.java checkLevel access control

A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserController.java of the component Users API Endpoint. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

VDB-361917 | eladmin Users API Endpoint UserController.java checkLevel access control technical-descriptionvdb-entry
VDB-361917 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
Submit #808771 | eladmin 2.7 Improper Access Controls third-party-advisory
https://github.com/elunez/eladmin/issues/897 exploitissue-tracking

Affected products

eladmin

==2.4
==2.6
==2.1
==2.5
==2.3
==2.7
==2.2
==2.0

Matching in nixpkgs

pkgs.python312Packages.wagtail-modeladmin

None

pkgs.python313Packages.wagtail-modeladmin

Add any model in your project to the Wagtail admin. Formerly wagtail.contrib.modeladmin

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0

pkgs.python314Packages.wagtail-modeladmin

Add any model in your project to the Wagtail admin. Formerly wagtail.contrib.modeladmin

nixos-unstable 2.3.0
- nixpkgs-unstable 2.3.0
- nixos-unstable-small 2.3.0

Package maintainers

@sephii Sylvain Fankhauser <sephi@fhtagn.top>