Authorization Bypass Vulnerability in Wikimedia Foundation's MediaWiki WikiLambda Extension
CVE-2026-103446

7.4HIGH

Key Information:

Vendor

The Wikimedia Foundation

Status
Mediawiki Wikilambda Extension
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103446?

An authorization bypass vulnerability exists in the WikiLambda extension of MediaWiki, allowing unauthorized users to bypass authentication mechanisms. This flaw is triggered by user-controlled keys, enabling potentially malicious actions. The vulnerability affects the MediaWiki WikiLambda extension version 1.46, posing a significant risk to the security of installations utilizing this component.

Affected Version(s)

MediaWiki WikiLambda extension 1.46

References

https://phabricator.wikimedia.org/T435086
https://gerrit.wikimedia.org/r/q/If2c05b109672fc65f63372f...

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Paciaroni (BomboBombone)
.