CVE-2026-96872 - WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Back Back to CVE browser

LOW

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Published Sep 23, 2026

2.9

LOW

CVSS 4.0

EPSS 0.23%

Description

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

Affected products

Vendor The Wikimedia Foundation Product Mediawiki - WikiLambda Extension Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.47.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

The Wikimedia Foundation

Mediawiki - WikiLambda Extension

unaffected

Version	Status	Constraints
0	affected	<1.47.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-280

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85562		Advisory
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1326392
https://phabricator.wikimedia.org/T435085