Wagtail, a Django‑based CMS, processed ETag conditional requests for the document serve endpoint before performing permission and filename checks. An unauthenticated user who knows a document ID and a candidate SHA1 hash can send an If‑Match or If‑None‑Match header and observe the response. By distinguishing between a 304 Not Modified and a standard 200 response, the attacker learns whether that specific hash value exists in the document repository. The flaw does not reveal document content, filenames, or other metadata beyond the hash that the attacker already knows, but it enables exhaustive enumeration of known or suspected hashes within the system.

All installations of Wagtail older than 7.0.9, 7.3.4, 7.4.3, or 8.0rc2 are affected. The vendor product is the open‑source CMS Wagtail.

The CVSS base score is 3.7, indicating a low‑severity information‑disclosure risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is over HTTP, requiring the attacker to know a document ID and a candidate hash, and to send a conditional request that the server will respond to before authorization checks are performed. Given the low severity and lack of exploitation data, the threat is primarily enumeration of hash values rather than immediate compromise of content.