CVE-2026-103446CWE-639

CVE-2026-103446

published September 30, 2026

CVSS
7.4
EPSS
0%
Percentile
24.7
In the wild
Unconfirmed
What it is

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.

This issue affects MediaWiki WikiLambda extension: 1.46.

The record
Technical detail
CVSS
7.4 · NONE
CVSS v4.0
7.4 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
EPSS
0.00328 · 24.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-30T22:18Z
References (2)
https://gerrit.wikimedia.org/r/q/If2c05b109672fc65f63372f86c768859dc6639fd · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T435086 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 17:13Z
    WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
    cvelistv5