CVE-2026-96872CWE-280

CVE-2026-96872

published September 23, 2026

CVSS
2.9
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

The record
Technical detail
CVSS
2.9 · NONE
CVSS v4.0
2.9 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/AU:Y
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2026-09-23T23:19Z
References (2)
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1326392 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T435085 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 18:50Z
    WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
    cvelistv5