CVE-2026-103446
Received Received - Intake

Authorization Bypass in MediaWiki WikiLambda Extension

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: wikimedia-foundation

Description
Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103446
EUVD
EUVD-2026-90199

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
the_wikimedia_foundation mediawiki_wikilambda_extension 1.46
the_wikimedia_foundation mediawiki_wikilambda_extension to 1.47.0-wmf.17 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the Wikimedia Foundation MediaWiki WikiLambda extension. It allows attackers to bypass authentication by exploiting a missing permission check in the abstractwiki_run_fragment API. Specifically, anonymous users can execute unsaved Abstract Wikipedia fragments containing native code implementations without proper authorization.

Detection Guidance

Check MediaWiki logs for unauthorized API calls to abstractwiki_run_fragment. Look for requests from anonymous users attempting to execute unsaved fragments with native code implementations.

Impact Analysis

This vulnerability enables unauthorized native-code execution in the WikiLambda evaluator service. While the current WASM-sandboxed evaluator prevents direct remote code execution or sandbox escape, it still allows attackers to submit and run malicious fragments. This could lead to unintended code execution within the evaluator boundary.

Mitigation Strategies

Upgrade MediaWiki WikiLambda extension to version 1.47.0-wmf.17 or later. Ensure the wikilambda-abstract-run-unsaved-fragment permission check is enforced in ApiAbstractWikiRunFragment class.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103446. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart