Threat level Severe
Contact
Critical 9.1
CVE-2026-100240

Wikimedia Foundation Mediawiki - TemplateSandbox Extension — missing authorization.

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.

Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploit chance, 30 days
0.3%
Higher than 22% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki – TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Mediawiki – TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

What to do

  1. 01Check whether you run Wikimedia Foundation Mediawiki - TemplateSandbox Extension, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-1185274.3Ivanti Connect SecureCVE-2026-1199778.1WordPress WordPress CoreCVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Vendor
Wikimedia Foundation0 CVEs in 30 days
All Wikimedia Foundation CVEs