GHSA-3vrh-m9w7-v94f Wagtail: Improper restriction handling on Pages admin API

• PyPI wagtail: < 7.0.9 → fixed in 7.0.9 • PyPI wagtail: >= 7.1, < 7.3.4 → fixed in 7.3.4 • PyPI wagtail: >= 7.4, < 7.4.3 → fixed in 7.4.3 • PyPI wagtail: >= 8.0rc1, < 8.0rc2 → fixed in 8.0rc2

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in `api_fields`. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of `api_fields` on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in `api_fields`. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. Workarounds Site owners unable to upgrade can apply the fix by overriding the relevant method on `PagesAdminAPIViewSet` to patch all vulnerable admin API endpoints: ```python wagtail_hooks.py or AppConfig.ready() from wagtail.admin.api.views import PagesAdminAPIViewSet from wagtail.permissions import page_permission_policy def _restricted_get_base_queryset(self): return page_permission_policy.explorable_instances(self.request.user) PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset ``` Acknowledgements Many thanks to xuliang@QAX for reporting this issue. For more information If you have any questions or comments about this advisory: • Visit Wagtail's support channels • Email us at [email protected] (view our security policy for more information).