Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-100240 EUVD-2026-89034GHSA-3835-4xp5-hjqc

TemplateSandbox does not check read permissions for the page being previewed

Published Sep 29, 2026 · Updated Oct 1, 2026 · Assigned by wikimedia-foundation

Description

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Affected products

VendorProductAffectedFixed
Wikimedia Foundation Mediawiki - TemplateSandbox Extension < 1.46.1, 1.45.5, 1.43.10 1.46.1, 1.45.5, 1.43.10

References