The vulnerability arises from improper restriction handling in the Documents and Images API, allowing an API user to enumerate filenames and names that belong to private collections. The affected data originates from the private collection metadata, so the impact is the potential disclosure of document identities and indirectly the content of private collections. The weakness corresponds to CWE-280, an improper limitation of permissions error.

The affected systems are installations of the Wagtail content management system prior to version 7.0.7, 7.3.2, or 7.4. Any deployment of those versions that exposes the Documents or Images API is vulnerable. The fix is available in the listed patch releases.

The CVSS score indicates a medium severity level of 5.3. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, implying a moderate likelihood of exploitation under normal circumstances. The likely attack vector is a legitimate API access request, meaning that an authenticated user who is authorized to call the API can trigger the disclosure; thus, proper access controls on the API endpoints are essential. Failure to patch the system exposes private document metadata to any API client that can reach the endpoint.