CVE-2026-100240: TemplateSandbox does not check read permissions for the page being previewed
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10.
Affected Software
Event History
Frequently Asked Questions
Which installations need remediation?
MediaWiki installations using the TemplateSandbox Extension are affected if they run a version before 1.46.1, 1.45.5, or 1.43.10.
What access does an attacker need to exploit this issue?
The issue concerns previewing a page through TemplateSandbox. The provided information does not specify any additional attacker privileges or prerequisites.
What information could be exposed?
Read permissions for the page being previewed are not checked, allowing access to functionality that is not properly constrained by ACLs. The provided information does not identify specific page content or data exposed.