{"id":"CVE-2026-103446","revision":"2c3c4aee328540e9a09a667faad0167a","records":[{"revision":"2c3c4aee328540e9a09a667faad0167a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-103446","aliases":[],"title":"WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments","description":"Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.\n\nThis issue affects MediaWiki WikiLambda extension: 1.46.","state":0,"publishedAt":"2026-09-30T17:13:02.339+00:00","modifiedAt":"2026-10-06T18:25:30.8+00:00","affected":[{"ecosystem":"Vendor product","name":"MediaWiki WikiLambda extension","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"The Wikimedia Foundation\",\n                    \"product\": \"MediaWiki WikiLambda extension\",\n                    \"repo\": \"https://gerrit.wikimedia.org/r/mediawiki/extensions/WikiLambda\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.46\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","score":7.4,"severity":"HIGH"}],"references":["https://phabricator.wikimedia.org/T435086","https://gerrit.wikimedia.org/r/q/If2c05b109672fc65f63372f86c768859dc6639fd"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103446","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103446","identifiers":["CVE-2026-103446"]},"retained":false,"historicalAffected":[]}],"coverage":[]}