CVE-2026-100378

MediumCVSS 5.3

Published: 25/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

The Translate extension for MediaWiki has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Risk Assessment

Unauthorized users may gain access to functions or data they should not have access to, potentially compromising confidentiality or integrity.

Recommendation

Update the Translate extension to version 1.46.1, 1.45.5, 1.43.10 or later.

Other vulnerabilities in MediaWiki Translate extension

CVE-2025-62699Medium
The Translate extension in MediaWiki (Wikimedia Foundation) has a vulnerability exposing sensitive information to unauthorized actors. The extension uses jobs to make edits to translation pages, causing CheckUser to log the wrong IP and User-Agent, making these edits unauditable via CheckUser. This affects versions from master before 1.39.

Original NVD description (English source)

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS