Description
_macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | moin | 1.5.3-1.2etch1 | DSA-1514-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moin | <= 1.5.8 | — | GHSA-jj2f-57jg-5rm6 |
Advisories 1
- DSA-1514-1 moin Debian Security (DSA / DLA) · Mar 9, 2026
References
- 30031 third-party-advisory
- 33755 third-party-advisory
- GLSA-200803-27 vendor-advisory
- 28177 vdb-entry
- 29262 third-party-advisory
- http://moinmo.in/SecurityFixes
- moinmoin-macrogetval-information-disclosure(41038) vdb-entry
- FEDORA-2008-3328 vendor-advisory
- FEDORA-2008-3301 vendor-advisory
- 29444 third-party-advisory
- USN-716-1 vendor-advisory
- http://hg.moinmo.in/moin/1.5/rev/4a7de0173734
- DSA-1514 vendor-advisory