UpHeron
All vulnerabilities

Servers and applications

CVE-2023-45809

Disclosure of user names via admin bulk action views

Severity
Low 2.7
Published
19 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.1.9, 5.0.5, 5.1.3
Also known as
GHSA-fc75-58r8-rm3h
Sources
NVD, Project advisories (GitHub)

Description

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters,…

Affected software

SoftwareAffected versions
WagtailServers and applications · cpe:a:torchbox:wagtail
  • Every version before 4.1.9
  • From 4.2 before 5.0.5
  • From 5.1 before 5.1.3
WagtailServers and applications · github:wagtail/wagtail
  • From 5.1 before 4.1.9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-45809
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-45809
  • GitHub Advisory Database https://github.com/advisories/GHSA-fc75-58r8-rm3h
  • github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-fc75-58r8-rm3h