CVE-2023-45809 Disclosure of user names via admin bulk action views in wagtail
Limited-permission editors can retrieve display names of any user via bulk action views, exposing sensitive user information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45809?
CVE-2023-45809 is a low-severity vulnerability in wagtail, published on 19 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 4.1.8 (LTS), 5.0.5 and 5.1.3. The fix is also included in Release Candidate 1 of the forthcoming Wagtail 5.2 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2023-45809?
7 open source packages ship an affected version, including wagtail. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wagtail PyPI | All versions | 4.1.9, 5.0.5, 5.1.3 |
wagtail PyPI | All versions | 4.1.9 |
wagtail PyPI | All versions | 4.1.9 |
wagtail PyPI | From 4.2.0 | 5.0.5 |
wagtail PyPI | From 4.2.0 | 5.0.5 |
wagtail PyPI | From 5.1.0 | 5.1.3 |
1 more packages
wagtail PyPI | From 5.1.0 | 5.1.3 |
Products include Torchbox Wagtail.
How do I fix CVE-2023-45809?
Upgrade wagtail to a fixed version for your release line: 4.1.9, 5.0.5 or 5.1.3.
Is CVE-2023-45809 being exploited?
There is no known exploitation of CVE-2023-45809 in the wild and no public exploit code.
Other vulnerabilities in wagtail
- CVE-2026-54263 Wagtail: Reflected XSS in dynamic image URL generator view
- CVE-2026-54261 Wagtail: Improper permission handling in image preview
- CVE-2026-44197 Wagtail: Improper permission handling when comparing revisions
- CVE-2026-44199 Wagtail: Improper permission handling when deleting form submissions
- CVE-2026-44200 Wagtail: Improper permission handling when copying pages
Sources
Also known as GHSA-fc75-58r8-rm3h, PYSEC-2023-219.