CVE-2026-103446

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation…

Risk score: 49/100
CVSS: 7.4 v4.0
Exploit chance (30 days): 0.3%
Published: 30 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 7.4 high

References

https://gerrit.wikimedia.org/r/q/If2c05b109672fc65f63372f86c768859dc6639fd
https://phabricator.wikimedia.org/T435086

Original description

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

Last activity 30 Sep 2026. Patch Forecast updates every hour.