CVE-2025-32964: Miraheze ManageWiki Auth Bypass Vulnerability

CVE-2025-32964 Overview

CVE-2025-32964 is an authorization bypass vulnerability in ManageWiki, a MediaWiki extension used by Miraheze and other wiki farms to allow administrators to manage wiki configuration through a web interface. The flaw allows a user without the ManageWiki-restricted right to disable a restricted extension by enabling a conflicting extension. The disable action proceeds automatically as part of conflict resolution, bypassing the permission check that would normally protect the restricted extension. The issue is tracked under CWE-285: Improper Authorization and was patched in commit 00bebea.

Critical Impact
Low-privileged wiki users can indirectly disable protected extensions without holding the ManageWiki-restricted permission, undermining the wiki farm's permission model.

Affected Products

Miraheze ManageWiki (MediaWiki extension)
All versions prior to commit 00bebea43a3e3ff0157b5f04df17c1d1e88a9acd
MediaWiki installations that deploy ManageWiki with restricted extensions in $wgManageWikiExtensions

Discovery Timeline

2025-04-22 - CVE-2025-32964 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32964

Vulnerability Analysis

ManageWiki exposes a web interface for managing per-wiki extension state. Administrators define extensions in the $wgManageWikiExtensions configuration array, and each entry can specify a permission required to toggle it. The ManageWiki-restricted right is intended to gate sensitive extensions from ordinary wiki administrators.

The vulnerability arises in the conflict-resolution path. When a user enables extension A, ManageWiki checks whether A conflicts with any currently enabled extension B. If so, ManageWiki automatically disables B to allow A to load. This automatic disable did not re-check whether the acting user held the permission required to disable B.

As a result, a user with rights to manage extension A can indirectly disable any restricted extension B that conflicts with A, without holding the ManageWiki-restricted right required for B. The vulnerability has network attack vector, requires low privileges, and requires user interaction on the ManageWiki form.

Root Cause

The root cause is a missing authorization check in the extension conflict handler within includes/FormFactory/ManageWikiFormFactory.php. The code that resolves conflicts assumed the calling user was authorized to disable the conflicting extension by virtue of being authorized to enable the requested one. Permission requirements declared in $wgManageWikiExtensions were not evaluated per-extension during conflict resolution.

Attack Vector

Exploitation requires an authenticated wiki user who holds permission to manage at least one extension in ManageWiki and who interacts with the ManageWikiExtensions form. The attacker enables a non-restricted extension deliberately configured to conflict with a restricted extension, triggering the automatic disable of the protected component. No memory corruption or code execution is achieved; the impact is limited to unauthorized configuration change with low integrity and availability effects.

text

// Patch excerpt from i18n/en.json (commit 00bebea)
- "managewiki-error-conflict": "The extension \"$1\" cannot enabled because it conflicts with $2.",
+ "managewiki-error-conflict": "The extension \"$1\" cannot be enabled because it conflicts with $2.",
// Source: https://github.com/miraheze/ManageWiki/commit/00bebea43a3e3ff0157b5f04df17c1d1e88a9acd

php

// Patch excerpt from includes/FormFactory/ManageWikiFormFactory.php
use MediaWiki\Context\IContextSource;
use MediaWiki\Html\Html;
use MediaWiki\HTMLForm\HTMLForm;
use MediaWiki\Language\RawMessage;
use MediaWiki\Output\OutputPage;
use MediaWiki\Permissions\PermissionManager;
use MediaWiki\Status\Status;
use Miraheze\CreateWiki\Services\RemoteWikiFactory;
use Miraheze\ManageWiki\ManageWikiOOUIForm;
use UnexpectedValueException;
// Source: https://github.com/miraheze/ManageWiki/commit/00bebea43a3e3ff0157b5f04df17c1d1e88a9acd

The patch introduces Status and RawMessage handling so the form does not save when errors, including permission conflicts, are detected.

Detection Methods for CVE-2025-32964

Indicators of Compromise

Entries in the MediaWiki logging table showing managewiki actions that disabled a restricted extension performed by a user account lacking the ManageWiki-restricted right.
Rapid sequences of extension-enable followed by automatic conflict-disable events attributed to the same non-privileged user.
Unexpected changes to the wiki's enabled extension list recorded in ManageWiki change logs.

Detection Strategies

Audit ManageWiki change history and cross-reference each extension disable event against the acting user's group memberships and rights at the time of the action.
Compare the current list of enabled extensions against a known-good baseline and flag any restricted extension that is unexpectedly disabled.
Review $wgManageWikiExtensions for conflict declarations that pair a restricted extension with an unrestricted one and treat those pairs as high-risk detection candidates.

Monitoring Recommendations

Forward MediaWiki and ManageWiki logs to a centralized log platform and alert on disables of extensions tagged as restricted.
Monitor the ManageWikiExtensions form endpoint for POST requests from accounts that do not hold ManageWiki-restricted.
Track configuration drift on the ManageWiki extension list and generate an alert when a protected extension transitions from enabled to disabled outside of change windows.

How to Mitigate CVE-2025-32964

Immediate Actions Required

Update ManageWiki to a revision that includes commit 00bebea43a3e3ff0157b5f04df17c1d1e88a9acd or later.
Review the wiki's logging table for prior unauthorized disables of restricted extensions and restore any that were turned off improperly.
Audit accounts that hold any ManageWiki management rights and remove unnecessary privileges pending patch deployment.

Patch Information

The vulnerability is fixed in ManageWiki commit 00bebea as described in GitHub Security Advisory GHSA-ccrf-x5rp-gppr. The corresponding source change is available in the GitHub commit details. Operators running ManageWiki from master should pull the latest revision; operators pinning a release should apply the patch on top of their current version.

Workarounds

Edit $wgManageWikiExtensions so that every extension conflicting with a restricted extension itself requires the ManageWiki-restricted permission, mirroring the protection on the sensitive component.
Temporarily remove conflict declarations that pair restricted and unrestricted extensions until the patch can be applied.
Restrict access to the ManageWikiExtensions form to trusted administrators through MediaWiki group permissions.

bash

# Configuration example: harden $wgManageWikiExtensions in LocalSettings.php
$wgManageWikiExtensions = [
    'restricted-ext' => [
        'name'        => 'RestrictedExtension',
        'restricted'  => true,
        'requires'    => [ 'permissions' => [ 'managewiki-restricted' ] ],
        'conflicts'   => 'other-ext',
    ],
    'other-ext' => [
        'name'        => 'OtherExtension',
        # Require the same permission so conflict-disable cannot bypass authorization
        'requires'    => [ 'permissions' => [ 'managewiki-restricted' ] ],
        'conflicts'   => 'restricted-ext',
    ],
];