The issue is an improper privilege check that allows users who cannot edit a page to compare two revisions of that page if they know the revisions’ primary keys. By viewing the comparison view, the attacker can read content from both revisions, thereby leaking information that should be restricted. This flaw is a typical example of improper privilege escalation, classified as CWE‑280.

Affected installations are those running Wagtail versions earlier than 7.0.7, 7.3.2, or 7.4. Users with standard (non‑editor) permissions are impacted because the vulnerability bypasses the permission gate. Upgrading to any supported release that includes the fix removes the flaw.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score is not listed, suggesting limited publicly documented exploitation at this time. The flaw can be exploited without authentication beyond a basic user account, and the attacker only needs to know two revision identifiers, which could be guessed or discovered through enumeration. The vulnerability is not yet catalogued in CISA’s KEV, but administrators should treat it as a potential disclosure risk.