CVE-2026-100378 Wikimedia Foundation CVE debrief

Who should care

Defenders responsible for Mediawiki - Translate Extension deployments should assess exposure and prioritize verification of affected versions.

Why it matters

Defenders should prioritize verifying affected versions and assessing exposure to the Missing Authorization vulnerability in Mediawiki - Translate Extension, as it allows unauthorized access to functionality.

• Verify affected versions to determine exposure
• Assess unauthorized access to functionality
• Implement compensating controls to restrict access

Technical summary

The Mediawiki - Translate Extension is vulnerable to Missing Authorization, allowing Accessing Functionality Not Properly Constrained by ACLs. This issue affects versions before 1.46.1, 1.45.5, 1.43.10. The vulnerability allows unauthorized access to functionality, potentially impacting confidentiality and integrity. Defenders should prioritize verifying affected versions and assessing exposure, as the vulnerability allows unauthorized access to functionality.

Defensive priority

Defenders should prioritize verifying affected versions and assessing exposure, as the vulnerability allows unauthorized access to functionality.

Recommended defensive actions

• Verify affected versions of Mediawiki - Translate Extension
• Assess exposure and unauthorized access to functionality
• Implement compensating controls to restrict access

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from official sources is needed to fully assess the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.