CVE-2026-103446

Published: Sep 30, 2026Modified: Oct 6, 2026

7.4

Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:AmberShow less

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (Secondary)

Description

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://gerrit.wikimedia.org/r/q/If2c05b109672fc65f63372f86c768859dc6639fd

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

https://phabricator.wikimedia.org/T435086

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Timeline

No history available yet.