{"id":"CVE-2026-103446","aliases":["EUVD-2026-90199","GHSA-4x94-p99h-wrcj"],"status":"published","title":"WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments","description":"Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.\n\nThis issue affects MediaWiki WikiLambda extension: 1.46.","severity":{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00328,"percentile":0.26261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-639"],"published":"2026-09-30T17:13:02Z","modified":"2026-10-06T19:17:39Z","exploits":[{"source":"pocgithub","id":"BomboBombone/CVE-2026-103446","title":"BomboBombone/CVE-2026-103446","date":"2026-09-30","url":"https://github.com/BomboBombone/CVE-2026-103446"}],"products":[{"vendor":"the wikimedia foundation","product":"mediawiki wikilambda extension"}],"references":[{"url":"https://phabricator.wikimedia.org/T435086"},{"url":"https://gerrit.wikimedia.org/r/q/If2c05b109672fc65f63372f86c768859dc6639fd"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103446"},{"url":"https://github.com/advisories/GHSA-4x94-p99h-wrcj"}],"sources":{"cve":[{"id":"CVE-2026-103446","title":"WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments","description":"Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.\n\nThis issue affects MediaWiki WikiLambda extension: 1.46.","status":"published","published":"2026-09-30T17:13:02.339Z","modified":"2026-10-06T18:25:30.8Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"high","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-90199","description":"Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.\n\nThis issue affects MediaWiki WikiLambda extension: 1.46.","status":"published","published":"2026-09-30T17:13:02Z","modified":"2026-10-06T18:25:30Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"high"}],"updated_at":"2026-11-02T17:27:36.701921Z"}],"ghsa":[{"id":"GHSA-4x94-p99h-wrcj","title":"Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation...","description":"Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.\n\nThis issue affects MediaWiki WikiLambda extension: 1.46.","status":"published","published":"2026-09-30T18:33:50Z","modified":"2026-09-30T18:34:00Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:12:38.152609Z"}],"nvd":[{"id":"CVE-2026-103446","description":"Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.\n\nThis issue affects MediaWiki WikiLambda extension: 1.46.","status":"published","published":"2026-09-30T18:18:17.017Z","modified":"2026-10-06T19:17:39.55Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"high","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:53.097633Z"}]}}