CVE-2026-100240

CriticalCVSS 9.1

Published: 29/09/2026(UTC)Updated: 01/10/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

3th percentile - higher than 3% of all known CVEs

Summary

Missing Authorization vulnerability in the TemplateSandbox extension for MediaWiki allows access to functionality not properly constrained by ACLs. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

Risk Assessment

An attacker may gain unauthorized access to extension functionality, potentially leading to data confidentiality or integrity breaches.

Recommendation

Immediately update the TemplateSandbox extension to version 1.46.1, 1.45.5, 1.43.10 or later.

Other vulnerabilities in MediaWiki TemplateSandbox Extension

CVE-2026-100376Medium
Cross-Site Scripting (XSS) vulnerability in Mediawiki TemplateSandbox Extension due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

Original NVD description (English source)

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS