CVE-2025-12004: The compare API module breaks Extension:Lockdown
Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12004?
CVE-2025-12004 is classified as a critical vulnerability due to its potential for privilege abuse.
How do I fix CVE-2025-12004?
To fix CVE-2025-12004, upgrade the MediaWiki - Lockdown Extension to version 1.42 or later.
Which software is affected by CVE-2025-12004?
CVE-2025-12004 affects the MediaWiki - Lockdown Extension versions from master up to, but not including, 1.42.
What type of vulnerability is CVE-2025-12004?
CVE-2025-12004 is an Incorrect Permission Assignment for Critical Resource vulnerability.
Who is responsible for fixing CVE-2025-12004?
The Wikimedia Foundation is responsible for providing fixes for CVE-2025-12004 in the affected MediaWiki software.