Medium · 5.3 CVE-2026-0817 EUVD-2026-1726GHSA-5v56-6x55-vhpv

CampaignEvents API missing authorization exposes meeting and chat URLs

Published Jan 9, 2026 · Updated Jan 9, 2026 · Assigned by wikimedia-foundation

Vendor: Wikimedia Foundation Product: MediaWiki - CampaignEvents extension Category: Web / CMS

Description

Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.

Affected products

Vendor	Product	Affected	Fixed
Wikimedia Foundation	MediaWiki - CampaignEvents extension	1.45, 1.44, 1.43, 1.39	—

References

https://phabricator.wikimedia.org/T410560
https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358