{"id":"CVE-2026-100240","revision":"2e3d364846264debb5baf6400a3545d4","records":[{"revision":"2e3d364846264debb5baf6400a3545d4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-100240","aliases":[],"title":"TemplateSandbox does not check read permissions for the page being previewed","description":"Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.","state":0,"publishedAt":"2026-09-29T16:26:31.215+00:00","modifiedAt":"2026-10-01T18:07:53.717+00:00","affected":[{"ecosystem":"Vendor product","name":"Mediawiki - TemplateSandbox Extension","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Wikimedia Foundation\",\n                    \"product\": \"Mediawiki - TemplateSandbox Extension\",\n                    \"repo\": \"https://gerrit.wikimedia.org/g/mediawiki/extensions/TemplateSandbox/+/refs/heads/master\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"*\",\n                            \"lessThan\": \"1.46.1, 1.45.5, 1.43.10\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://phabricator.wikimedia.org/T407974","https://gerrit.wikimedia.org/r/q/Iaf9f6e2280798af5516197257ddc0264b9ad9fb7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100240","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-100240","identifiers":["CVE-2026-100240"]},"retained":false,"historicalAffected":[]}],"coverage":[]}