EUVD-2026-40900
GHSA-vjf9-r75w-m9fv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CSRF canonically requires victim interaction (UI:R); impact is limited to redirect content manipulation (I:L) with no confidentiality or availability consequence from redirect forgery alone.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery.
This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3.
AnalysisAI
Cross-site request forgery in the Wikimedia Foundation's MediaWiki RedirectManager Extension (all versions before 1.3.3) enables remote attackers to perform unauthorized redirect management actions on behalf of authenticated wiki users. The CVSS 4.0 base score of 6.9 (Medium) reflects network-accessible exploitation with low impact across confidentiality, integrity, and availability dimensions on both vulnerable and subsequent systems. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Technical ContextAI
The RedirectManager Extension for MediaWiki (CPE: cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_redirectmanager_extension:*:*:*:*:*:*:*:*) provides wiki editors and administrators with a dedicated interface for creating and managing page redirects within a MediaWiki installation. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the extension fails to validate that state-changing requests originate from the legitimate wiki interface rather than a third-party origin, likely because affected code paths accept redirect management actions without requiring an unguessable synchronizer token or verifying the HTTP Referer/Origin header. CSRF vulnerabilities exploit the browser's automatic inclusion of session credentials (cookies) on cross-origin requests, allowing a malicious page to trigger authenticated actions. The vulnerability is tracked in Wikimedia's Phabricator at T423826 and patched via Gerrit change 1275494.
RemediationAI
Upgrade the MediaWiki RedirectManager Extension to version 1.3.3 or later, which incorporates the CSRF protection fix implemented in Gerrit change https://gerrit.wikimedia.org/r/c/mediawiki/extensions/RedirectManager/+/1275494. Wiki administrators should pull the updated extension code from the Wikimedia Gerrit repository and redeploy. If immediate upgrade is not feasible, the most effective compensating control is to disable the RedirectManager Extension entirely by removing or commenting out its inclusion in LocalSettings.php - this eliminates the attack surface with no functional loss beyond the redirect management UI, since redirects can still be managed through standard MediaWiki page editing. Alternatively, restricting redirect management permissions to a tightly controlled trusted user group via MediaWiki's permission system reduces the victim pool for a successful CSRF attack, though it does not eliminate the vulnerability. WAF rules enforcing same-origin policy on redirect management endpoints may block some attack vectors but are not a reliable substitute for patching.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today