CVE-2025-12004CWE-732

CVE-2025-12004

published October 21, 2025

CVSS
10.0
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

The record
Technical detail
CVSS
10.0 · NONE
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.3th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-10-21T11:15Z
References (3)
https://gerrit.wikimedia.org/r/q/Id275382743957004fa7fc56318fc104d8e2d267b · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T397521 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T397521 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 21 OCT 06:20Z
    The compare API module breaks Extension:Lockdown
    cvelistv5