Code Injection Vulnerability in MediaWiki CentralAuth Extension by Wikimedia Foundation
CVE-2026-103442

7.2HIGH

Key Information:

Vendor

The Wikimedia Foundation

Status
Mediawiki Centralauth Extension
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103442?

A vulnerability exists in the MediaWiki CentralAuth extension that allows external entities to manipulate system or configuration settings, leading to potential code injection. This issue impacts versions 1.46, 1.45, and 1.43. Users of affected versions are encouraged to update their installations to mitigate risk.

Affected Version(s)

MediaWiki CentralAuth extension 1.46

MediaWiki CentralAuth extension 1.45

MediaWiki CentralAuth extension 1.43

References

https://phabricator.wikimedia.org/T435624
https://gerrit.wikimedia.org/r/q/I9c59e5c3f217c1eaa02934a...

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Paciaroni (BomboBombone)
.