Missing Authorization Vulnerability in Mediawiki TemplateSandbox Extension by Wikimedia Foundation

CVE-2026-100240

What is CVE-2026-100240?

A missing authorization vulnerability in the Mediawiki TemplateSandbox Extension allows unauthorized access rights, permitting users to exploit functionalities without proper access control lists (ACLs). This vulnerability notably affects versions prior to 1.46.1, specifically 1.45.5 and 1.43.10. Administrators are encouraged to update to secure versions to safeguard against potential misuse.

References