{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58517", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-07-01T03:40:44.768Z", "datePublished": "2026-07-01T18:23:02.161Z", "dateUpdated": "2026-07-01T18:35:06.496Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-07-01T18:23:02.161Z"}, "title": "Blocked users can create and edit WikiLambda objects", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-288", "description": "CWE-288 Authentication bypass using an alternate path or channel", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - WikiLambda Extension", "versions": [{"status": "affected", "version": "*", "lessThan": "1.43.9,1.44.6,1.45.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.\n\nThis issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.<p>This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.</p>"}]}], "references": [{"url": "https://phabricator.wikimedia.org/T428833"}, {"url": "https://gerrit.wikimedia.org/r/c/1305376"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "SomeRandomDeveloper", "type": "finder"}, {"lang": "en", "value": "Jdforrester-WMF", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T18:34:52.042792Z", "id": "CVE-2026-58517", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T18:35:06.496Z"}}]}}

{}

{}

{"bugzilla": {"description": "wikilambda: WikiLambda Extension: Authentication bypass due to improper input neutralization", "id": "2496133", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496133"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-140", "details": ["Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.\nThis issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.", "A flaw was found in The Wikimedia Foundation Mediawiki - WikiLambda Extension. This vulnerability, caused by improper neutralization of input terminators, allows an attacker to bypass authentication. This could lead to unauthorized access to the system."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, disable the MediaWiki WikiLambda Extension if it is not required for your deployment. This can typically be achieved by commenting out or removing the extension's entry in the LocalSettings.php configuration file. Restricting network access to the MediaWiki instance to trusted networks or users can also reduce exposure. Disabling the extension will affect any functionality dependent on WikiLambda."}, "name": "CVE-2026-58517", "public_date": "2026-07-01T18:23:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58517\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58517\nhttps://gerrit.wikimedia.org/r/c/1305376\nhttps://phabricator.wikimedia.org/T428833"], "statement": "This Critical flaw in the Mediawiki WikiLambda Extension allows an unauthenticated attacker to bypass authentication mechanisms due to improper input neutralization. This could lead to unauthorized access to systems where the WikiLambda Extension is deployed and enabled, posing a significant risk to data integrity and confidentiality.", "threat_severity": "Critical"}