# Wagtail 8.0 release notes _August 25, 2026_ ```{contents} --- local: depth: 1 --- ``` ## What's new ### Wagtail REST API v3 (preview) Wagtail 8.0 introduces a preview of a new [v3 API](api_v3), built on [Django Ninja](https://django-ninja.dev/) and type hints. The v2 API was designed for headless site and other data publication needs. v3 serves similar use cases, and adds support for CMS operations on top: authenticated clients can create, edit, publish and unpublish, move, copy, and revert content, and manage revisions, across pages, sites, locales, redirects, images, documents, and API-enabled snippets. You can create new pages with writable StreamField content, rich text as HTML or Markdown. The API auto-generates precise OpenAPI 3.1 schemas based on your project’s models, and uses API token authentication tied to user accounts. See the [v3 API documentation](api_v3) for full details. The v3 API is released as a preview to signify we want to adapt it based on feedback: it may change in backwards-incompatible ways in any release until stabilised. We welcome [feedback via discussions](https://github.com/wagtail/wagtail/discussions/14531), feature requests and bug reports. This feature was developed by Thibaud Colas and Sage Abdullah. ### Custom base page models This release introduces [the ability to swap out the base `Page` model](custom_page_models) with a custom project-specific model. Any fields and methods defined on this model will be shared by all page types. This feature is only supported for newly-created projects, and certain add-on packages may not yet be compatible with it (see [](reusable_app_base_page)). This feature was developed by Matt Westcott. ### Permission policy registry A permission policy for every model managed by Wagtail is now registered to a global permission policy registry. The registry allows you to retrieve the permission policy of a model from anywhere in the code, which can be useful for performing permission checks outside of a view's request-response cycle, such as in a background task. It can also be used to implement custom permission logic, including for Wagtail's built-in models. For more details, refer to the [](permissions_reference) reference documentation. This feature was developed by Sage Abdullah. ### Django 6.1 support This release introduces formal support for [Django 6.1](https://docs.djangoproject.com/en/6.1/releases/6.1/). ### Guide website improvements The [Wagtail user guide](https://guide.wagtail.org/) has been updated to use a new versioning scheme, better search and navigation, and better support for Right-to-Left (RTL) languages. Thank you to Raghad Dahi for leading this work. For more information, read her project report: [Streamlining content ops with LLMs: Wagtail user guide](https://wagtail.org/blog/streamlining-content-operations-with-llms-wagtail-user-guide/). ### Automated dependency management We now provide [SBOM exports of our dependency graph](https://github.com/wagtail/wagtail/network/dependencies) in SPDX JSON format. This complements a number of improvements to dependency management, implemented by Sage Abdullah, Dan Braghis, and Thibaud Colas: * Automated testing with latest versions of all dependencies * Lockfiles and pinned dependencies for reproducible CI builds * zizmor for GitHub Actions quality checks * Automated dependency updates via Renovate ### Security fix: Improper restriction handling on Pages admin API The internal Pages admin API incorrectly returned page fields without access control when they were declared in `api_fields`. A user with access to the Wagtail admin could use this API to fetch draft and live page fields’ contents that are part of `api_fields` on the base page model (title, slug, seo_title, search_description), as well as all custom fields declared in `api_fields`. Many thanks to xuliang@QAX for reporting this issue. For further details, please see [security advisory GHSA-3vrh-m9w7-v94f](https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f). ### Security fix: Identification of documents by SHA1 hash By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. Many thanks to Anand Himanshu for reporting this issue. For further details, please see [security advisory GHSA-92hv-j533-69wc](https://github.com/wagtail/wagtail/security/advisories/GHSA-92hv-j533-69wc). ### Security fix: Improper restriction handling on descendant collections in Documents and Images API The Documents and Images API incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. Many thanks to Ta Duc Thien for reporting this issue. For further details, please see [security advisory GHSA-c2xx-cjmh-9q8f](https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f). ### Security fix: Improper permission handling when copying snippets A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. Many thanks to tinyb0y for reporting this issue. For further details, please see [security advisory GHSA-x5cx-w6p2-mxf2](https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2). ### Security fix: Improper restriction handling on Page translation API endpoint A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Many thanks to tinyb0y for reporting this issue. For further details, please see [security advisory GHSA-jm5p-837g-rv8g](https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g). ### Other features * Add customizability for all remaining page views to `PageViewSet` (Sage Abdullah) * Set `FieldPanel(required_on_save=True)` for `AbstractFormField`'s `field_type` field (Alex Tomkins) * Handle pasting of multiple tags separated by newlines or commas (Matthias Brück) * Make `Button` component render a `