{"id":"CVE-2026-0817","aliases":["EUVD-2026-1726","GHSA-5v56-6x55-vhpv"],"status":"published","title":"CampaignEvents API missing authorization exposes meeting and chat URLs","description":"Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00272,"percentile":0.19648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-01-09T15:50:50Z","modified":"2026-06-17T10:11:26Z","products":[{"vendor":"the wikimedia foundation","product":"mediawiki - campaignevents extension"},{"vendor":"wikimedia","product":"campaignevents"},{"vendor":"wikimedia foundation","product":"mediawiki - campaignevents extension"}],"references":[{"url":"https://phabricator.wikimedia.org/T410560","tags":["Issue Tracking"]},{"url":"https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0817"},{"url":"https://github.com/advisories/GHSA-5v56-6x55-vhpv"}],"sources":{"cve":[{"id":"CVE-2026-0817","title":"CampaignEvents API missing authorization exposes meeting and chat URLs","description":"Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.","status":"published","published":"2026-01-09T15:50:50.616Z","modified":"2026-01-09T17:37:36.036Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-1726","description":"Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.","status":"published","published":"2026-01-09T15:50:50Z","modified":"2026-01-09T17:37:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:54.107539Z"}],"ghsa":[{"id":"GHSA-5v56-6x55-vhpv","title":"Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension...","description":"Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.","status":"published","published":"2026-01-09T18:31:36Z","modified":"2026-01-09T18:31:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:05:33.510969Z"}],"nvd":[{"id":"CVE-2026-0817","description":"Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.","status":"published","published":"2026-01-09T16:16:08.03Z","modified":"2026-06-17T10:11:26.027Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:03.683495Z"}]}}