Insufficient Permissions Vulnerability in Wikimedia Foundation Mediawiki WikiLambda Extension
CVE-2026-96872

2.9LOW

Key Information:

Vendor

The Wikimedia Foundation

Status
Mediawiki - Wikilambda Extension
Vendor
CVE Published:
23 September 2026

What is CVE-2026-96872?

An improper handling of insufficient permissions vulnerability in the Mediawiki WikiLambda Extension allows users to access functionalities that are not adequately constrained by Access Control Lists (ACLs). This issue impacts users across various operating systems, including Linux, MacOS, and Windows, and affects versions prior to 1.47.0. It enables unauthorized access that could lead to unintended actions within the Mediawiki platform.

Affected Version(s)

Mediawiki - WikiLambda Extension Linux 0 < 1.47.0

References

https://phabricator.wikimedia.org/T435085
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wik...

CVSS V4

Score:
2.9
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bombobombone
.