Missing Authorization in MediaWiki Translate Extension

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: wikimedia-foundation

Description

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100378

Affected Vendors & Products

Vendor	Product	Version / Range
wikimedia	mediawiki_translate_extension	to 1.46.1 (exc)
wikimedia	mediawiki_translate_extension	1.45.5
wikimedia	mediawiki_translate_extension	1.43.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authorization issue in the Wikimedia Foundation Mediawiki - Translate Extension. It allows users to access functionality that should be restricted by access control lists (ACLs). This means unauthorized users might perform actions they are not permitted to do.

Impact Analysis

If you use the affected versions of the Mediawiki - Translate Extension, an attacker could exploit this to perform unauthorized actions. This might lead to data leaks, unauthorized modifications, or misuse of the translation features.

Mitigation Strategies

Update the Mediawiki Translate Extension to version 1.46.1 or later, 1.45.5, or 1.43.10 depending on your current version to address the missing authorization issue.

Hi! I’m here to help you understand CVE-2026-100378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70