BaseFortify

Publication date: 2025-10-21

Last updated on: 2025-10-22

Assigner: wikimedia-foundation

Description

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension: from 1.43 before 1.44.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-21

Last Modified

2025-10-22

Generated

2026-07-06

AI Q&A

2025-10-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62661

EUVD

EUVD-2025-35215

Affected Vendors & Products

Vendor	Product	Version / Range
wikimedia	mediawiki_thanks_extension	*
wikimedia	mediawiki	1.44
wikimedia	mediawiki_growth_experiments_extension	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-276	During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Default Permissions issue in the Wikimedia Foundation's Mediawiki Thanks Extension and Growth Experiments Extension. It allows access to functionality that is not properly restricted by Access Control Lists (ACLs), meaning users might be able to use features they should not have permission to access.

Impact Analysis

This vulnerability can lead to unauthorized access to certain functions within the affected Mediawiki extensions, potentially allowing users to perform actions beyond their intended permissions. This could result in misuse or abuse of the system's features.

Hi! I’m here to help you understand CVE-2025-62661. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70