CVE-2026-100240CWE-862broken-access-control

CVE-2026-100240

Critical · published September 29, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00298 · 21.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-29T21:17Z
References (2)
https://gerrit.wikimedia.org/r/q/Iaf9f6e2280798af5516197257ddc0264b9ad9fb7 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T407974 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 16:26Z
    TemplateSandbox does not check read permissions for the page being previewed
    cvelistv5