{"cve":"CVE-2022-21683","nvd":{"published":"2022-01-18T18:15:08.430","modified":"2026-06-17T04:26:45.333","status":"Modified","description":"Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not have editing access to, as long as they have left a comment or reply somewhere on the site. A patched version has been released as Wagtail 2.15.2, which restores the intended behaviour - to send notifications for new replies to the participants in the active thread only (editing permissions are not considered). New comments can be disabled by setting `WAGTAILADMIN_COMMENTS_ENABLED = False` in the Django settings file.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-200"],"references":["https://github.com/wagtail/wagtail/commit/5fe901e5d86ed02dbbb63039a897582951266afd","https://github.com/wagtail/wagtail/releases/tag/v2.15.2","https://github.com/wagtail/wagtail/security/advisories/GHSA-xqxm-2rpm-3889","https://github.com/wagtail/wagtail/commit/5fe901e5d86ed02dbbb63039a897582951266afd","https://github.com/wagtail/wagtail/releases/tag/v2.15.2"],"products":["torchbox:wagtail"],"source":"nvd","synced_at":"2026-10-19T21:27:20.926095847+00:00"},"epss":{"cve":"CVE-2022-21683","score":0.0097,"percentile":0.61892,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xqxm-2rpm-3889","url":"https://osv.dev/vulnerability/GHSA-xqxm-2rpm-3889","summary":"Comment reply notifications sent to incorrect users","modified":"2024-11-19T16:22:53.380785Z","packages":[{"ecosystem":"PyPI","name":"wagtail","purl":"pkg:pypi/wagtail","ranges":[">=2.13 <2.15.2"],"fixed":["2.15.2"]}]},{"id":"PYSEC-2022-13","url":"https://osv.dev/vulnerability/PYSEC-2022-13","summary":"","modified":"2023-11-08T04:08:07.593204Z","packages":[{"ecosystem":"PyPI","name":"wagtail","purl":"pkg:pypi/wagtail","ranges":[">=2.13 <2.15.2"],"fixed":["2.15.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}