CVE-2026-96872
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The WikiLambda extension for MediaWiki before version 1.47.0 has improper handling of insufficient permissions, allowing access to functionality not properly constrained by ACLs. The issue affects Linux, MacOS, and Windows.
Risk Assessment
A user may gain access to functions they should not have permissions for, potentially leading to unauthorized operations on the wiki. Requires the WikiLambda extension installed.
Recommendation
Upgrade the WikiLambda extension to version 1.47.0 or later. Review and harden ACL configuration in MediaWiki.
Other vulnerabilities in MediaWiki WikiLambda Extension
See all- CVE-2026-100383Medium
The WikiLambda extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects version 1.47.0-alpha and has been remediated on the master branch.
- CVE-2026-100377Medium
Vulnerability of sensitive information exposure to unauthorized actor in Mediawiki WikiLambda Extension. Affects version 1.47.0-alpha and has been remediated on the master branch.
- CVE-2026-58517Medium
A vulnerability in the WikiLambda extension for MediaWiki allows authentication bypass due to improper neutralization of input terminators. Affects versions before 1.43.9, 1.44.6, and 1.45.4.
Original NVD description (English source)
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS