Improper Permissions Management in Wikimedia Foundation MediaWiki Application
CVE-2025-32697

NONE

Key Information:

Vendor
Wikimedia Foundation
Status
Mediawiki
Vendor
CVE Published:
10 April 2025

Summary

A vulnerability exists in the Wikimedia Foundation's MediaWiki software that entails improper management of permissions. The flaw is present in several program files, including 'includes/editpage/IntroMessageBuilder.php', 'includes/Permissions/PermissionManager.php', and 'includes/Permissions/RestrictionStore.php'. This issue allows unauthorized access or modifications by users who should not have those privileges, potentially leading to data breaches or misuse of the system. Developers and administrators using affected versions prior to 1.42.6 or 1.43.1 are strongly advised to update their installations to mitigate this risk.

Affected Version(s)

MediaWiki 0 < 1.42.6, 1.43.1

References

https://phabricator.wikimedia.org/T140010
https://phabricator.wikimedia.org/T62109
https://phabricator.wikimedia.org/T24521

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.