CVE-2026-103442

HighCVSS 7.2

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

Risk Assessment

The risk includes the possibility of executing malicious code in the MediaWiki context, potentially leading to wiki takeover and data compromise.

Recommendation

Update the CentralAuth extension to the latest available version. Restrict access to system configuration and monitor setting changes.

Other vulnerabilities in MediaWiki CentralAuth

CVE-2026-58028Medium
An XSS vulnerability in MediaWiki and CentralAuth allows an attacker to inject malicious scripts into a web page generated by the application. The issue affects several source files including ApiFormatBase.php and ApiHelp.php.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS