Vulnerability · Published Sep 30, 2026 · Assigned by wikimedia-foundation

CVE-2026-103446WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

High 7.4

In plain English

A high-severity authorization bypass via user-controlled key in MediaWiki WikiLambda extension from The Wikimedia Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)7.4High

Exploit odds (30 days)0.3%top 73.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

Affected products (as reported)

Vendor	Product	Versions
The Wikimedia Foundation	MediaWiki WikiLambda extension	1.46

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

In plain English

Official description

Affected products (as reported)

References