CVE-2026-103446: WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.
This issue affects MediaWiki WikiLambda extension: 1.46.
Affected Software
Event History
Frequently Asked Questions
Which deployments are identified as affected?
The issue is identified in the Wikimedia Foundation MediaWiki WikiLambda extension version 1.46. The provided data does not state whether earlier or later versions are affected.
What does the available scoring data indicate about exploitation prerequisites?
The CVSS vector indicates network-based exploitation with high attack complexity, additional attack requirements, low attacker privileges, and passive user interaction. The vector therefore does not describe an entirely unauthenticated, no-interaction attack path.
What is the potential security impact if exploitation succeeds?
The CVSS assessment rates confidentiality, integrity, and availability impact as high for both the vulnerable system and subsequent systems. The overall severity is high, with a score of 7.4.