Medium · 6.9 CVE-2026-58517 EUVD-2026-41114GHSA-9r5v-wvvq-6v9f

Blocked users can create and edit WikiLambda objects

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by wikimedia-foundation

Description

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.

This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

Vendor	Product	Affected	Fixed
The Wikimedia Foundation	Mediawiki - WikiLambda Extension	< 1.43.9,1.44.6,1.45.4	1.43.9,1.44.6,1.45.4