CVE-2026-96872 Overview
CVE-2026-96872 is an improper access control vulnerability in the Wikimedia Foundation's MediaWiki WikiLambda Extension. The flaw stems from insufficient enforcement of permissions and privileges, allowing network-based actors to reach functionality that should be restricted by Access Control Lists (ACLs) [CWE-280]. The extension is affected on Linux, macOS, and Windows deployments in all versions prior to 1.47.0. Wikimedia tracks the fix in a public Gerrit change and a Phabricator task. The issue has limited confidentiality impact and no direct integrity or availability impact, but it can expose functionality not intended for unauthenticated users.
Critical Impact
Unauthenticated network attackers can access WikiLambda functionality that should be restricted by ACLs, resulting in limited disclosure of information from the vulnerable component and downstream systems.
Affected Products
- MediaWiki WikiLambda Extension on Linux
- MediaWiki WikiLambda Extension on macOS
- MediaWiki WikiLambda Extension on Windows (all versions before 1.47.0)
Discovery Timeline
- 2026-09-23 - CVE-2026-96872 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-96872
Vulnerability Analysis
The WikiLambda Extension adds function-evaluation capabilities to MediaWiki, integrating with the Wikifunctions project. CVE-2026-96872 arises because certain extension entry points do not correctly verify caller permissions before executing privileged operations or returning data. As a result, requests that should be rejected by MediaWiki's ACL layer are processed. The vulnerability is exploitable over the network without authentication or user interaction, though attack complexity is high because specific request conditions must be met. Exploitation yields limited confidentiality impact on the vulnerable system and a subsequent limited impact on connected components. The upstream fix is tracked in the Wikimedia Gerrit Code Review and the corresponding Wikimedia Phabricator Task.
Root Cause
The defect is classified as CWE-280: Improper Handling of Insufficient Permissions or Privileges. WikiLambda code paths accept a request and proceed with the associated operation without confirming that the caller holds the required rights. The MediaWiki permissions framework returns or signals a shortfall, but the extension does not act on that signal. This gap enables access to functionality that the ACL policy defines as restricted.
Attack Vector
An attacker sends crafted HTTP requests to the MediaWiki instance targeting WikiLambda endpoints. No credentials or user interaction are required. The high attack complexity indicates that request timing, parameter values, or wiki configuration must align for the bypass to succeed. Successful requests return data or trigger actions that ACLs were intended to block, exposing WikiLambda content or function metadata to unauthorized callers.
No public proof-of-concept exploit is available. Refer to the linked Gerrit change for the specific code paths modified in the fix.
Detection Methods for CVE-2026-96872
Indicators of Compromise
- Unauthenticated HTTP requests to WikiLambda API endpoints (paths containing wikilambda, ZObject, or wikifunctions) that return 200 OK instead of permission errors.
- Access log entries showing anonymous users invoking function-evaluation or object-manipulation actions normally reserved for privileged accounts.
- Abnormal spikes in requests to WikiLambda-related action= API parameters from a single source.
Detection Strategies
- Review MediaWiki access logs for requests to WikiLambda routes originating from unauthenticated sessions and correlate against expected ACL behavior.
- Compare pre- and post-patch response codes for WikiLambda endpoints to identify requests that previously succeeded but should have been denied.
- Deploy web application firewall (WAF) rules that flag anonymous access to WikiLambda administrative or evaluation endpoints.
Monitoring Recommendations
- Enable verbose logging on the MediaWiki permissions subsystem to capture authorization decisions for WikiLambda requests.
- Forward MediaWiki and reverse-proxy logs to a centralized SIEM for correlation and long-term retention.
- Alert on any WikiLambda API response returning sensitive object data to sessions without an authenticated user identifier.
How to Mitigate CVE-2026-96872
Immediate Actions Required
- Upgrade the MediaWiki WikiLambda Extension to version 1.47.0 or later on all Linux, macOS, and Windows hosts running MediaWiki.
- Inventory MediaWiki installations that load the WikiLambda extension and prioritize internet-facing wikis for patching.
- Review recent access logs for anonymous requests to WikiLambda endpoints to identify possible pre-patch abuse.
Patch Information
The Wikimedia Foundation resolved the issue in WikiLambda Extension 1.47.0. The upstream code change is published in the Wikimedia Gerrit Code Review, and coordination is tracked in the Wikimedia Phabricator Task. Administrators should pull the fixed release from the official MediaWiki extension distribution channel used by their deployment.
Workarounds
- Disable the WikiLambda extension in LocalSettings.php until the patched version can be deployed.
- Restrict access to WikiLambda API routes at the reverse proxy or WAF layer, denying anonymous requests to those paths.
- Require authentication for all MediaWiki API endpoints on affected wikis where the extension cannot be immediately disabled.
# Configuration example: disable WikiLambda in LocalSettings.php
# wfLoadExtension( 'WikiLambda' ); // comment out until upgraded to 1.47.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.