Wagtail: Improper restriction handling on Pages admin API
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
Wagtail: Improper restriction handling on Page translation API endpoint
### Impact
A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.
### Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
### Workarounds
N/A
### Acknowledgements
Many thanks to tinyb0y for reporting this issue.
### For more information
If you have any questions or comments about this advisory:
* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Email us at [[email protected]](mailto:[email protected]) (view
Wagtail: Improper permission handling when copying snippets
### Impact
A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.
### Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
### Workarounds
N/A
### Acknowledgements
Many thanks to tinyb0y for reporting this issue.
### For more information
If you have any questions or comments about this advisory:
* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)
* Email us at [[email protected]](mailto:[email protected]) (view our [security pol
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
### Impact
The Documents and Images [API V2](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections.
### Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
### Workarounds
Site owners using Wagtail's API can avoid the vulnerability by adding [authentication](https://docs.wagtail.org/en/stable/advanced_topics/api/v2/configuration.html#authenti
### Impact
By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library.
This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash.
### Patches
Patched versions have been