Sensitive Information Exposure in Wikimedia Mediawiki - WikiLambda Extension
CVE-2026-100377

6.9MEDIUM

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Wikilambda Extension
Vendor
CVE Published:
25 September 2026

What is CVE-2026-100377?

A vulnerability was discovered in the Mediawiki - WikiLambda Extension developed by the Wikimedia Foundation, which allows unauthorized actors to access sensitive information. This security flaw primarily affects version 1.47.0-alpha of the extension and has been addressed in the latest updates. Users should ensure they are using updated versions to mitigate risks associated with potential data exposure.

Affected Version(s)

Mediawiki - WikiLambda Extension 1.47.0-alpha

References

https://phabricator.wikimedia.org/T430601
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wik...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SomeRandomDeveloper
.