Description
security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | moin | 1.9.3-1+squeeze2 | DSA-2538-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moin | >= 1.9, < 1.9.5 | 1.9.5 | GHSA-g4mx-rm5q-vh24 |
Advisories 1
- DSA-2538-1 moin - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-1604-1 vendor-advisory
- 50496 third-party-advisory
- http://moinmo.in/SecurityFixes
- DSA-2538 vendor-advisory
- [oss-security] 20120904 CVE request: moinmoin incorrect ACL evaluation for virtual groups mailing-list
- 50885 third-party-advisory
- 50474 third-party-advisory
- http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16
- [oss-security] 20120904 Re: CVE request: moinmoin incorrect ACL evaluation for virtual groups mailing-list