UpHeron
All vulnerabilities

Servers and applications

CVE-2022-21683

Comment reply notifications sent to incorrect users

Severity
Medium 4.3
Published
18 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.15.2
Also known as
GHSA-xqxm-2rpm-3889
Sources
NVD, Project advisories (GitHub)

Description

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not have editing access to, as long…

Affected software

SoftwareAffected versions
WagtailServers and applications · cpe:a:torchbox:wagtail
  • From 2.13 before 2.15.2
WagtailServers and applications · github:wagtail/wagtail
  • From 2.13 before 2.15.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21683
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21683
  • GitHub Advisory Database https://github.com/advisories/GHSA-xqxm-2rpm-3889
  • github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-xqxm-2rpm-3889