CVE-2026-103442CWE-15

CVE-2026-103442

published September 30, 2026

CVSS
7.2
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection.

This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
7.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-15 · External Control of System or Configuration Setting
Published
2026-09-30T20:17Z
References (2)
https://gerrit.wikimedia.org/r/q/I9c59e5c3f217c1eaa02934a076604049bac2b025 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T435624 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 16:09Z
    MergeAccount PHP object injection via session-key substitution
    cvelistv5