{"id":"CVE-2026-100240","aliases":["EUVD-2026-89034","GHSA-3835-4xp5-hjqc"],"status":"published","title":"TemplateSandbox does not check read permissions for the page being previewed","description":"Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00298,"percentile":0.22627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-29T16:26:31Z","modified":"2026-10-01T21:32:44Z","products":[{"vendor":"wikimedia foundation","product":"mediawiki - templatesandbox extension"}],"references":[{"url":"https://phabricator.wikimedia.org/T407974"},{"url":"https://gerrit.wikimedia.org/r/q/Iaf9f6e2280798af5516197257ddc0264b9ad9fb7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100240"},{"url":"https://github.com/advisories/GHSA-3835-4xp5-hjqc"}],"sources":{"cve":[{"id":"CVE-2026-100240","title":"TemplateSandbox does not check read permissions for the page being previewed","description":"Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.","status":"published","published":"2026-09-29T16:26:31.215Z","modified":"2026-10-01T18:07:53.717Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:06.925367Z"}],"euvd":[{"id":"EUVD-2026-89034","description":"Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.","status":"published","published":"2026-09-29T16:26:31Z","modified":"2026-10-01T18:07:53Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:27:44.322377Z"}],"ghsa":[{"id":"GHSA-3835-4xp5-hjqc","title":"Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension...","description":"Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.","status":"published","published":"2026-09-29T18:31:46Z","modified":"2026-10-01T21:32:44Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:12:41.196374Z"}],"nvd":[{"id":"CVE-2026-100240","description":"Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.","status":"published","published":"2026-09-29T17:17:01Z","modified":"2026-10-01T19:17:16.217Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:52.413234Z"}]}}