MediaWiki WikiLambda EUVD-2026-85562

Requires a reachable MediaWiki instance running the WikiLambda extension at a version before 1.47.0 (the extension powering Wikifunctions). Exploitation is remote and unauthenticated (PR:N/UI:N) but has high attack complexity (AC:H), so it likely depends on a specific request pattern, function state, or race that defeats the intended ACL check rather than working against arbitrary default requests. Impact is limited to low-severity information disclosure of functionality that should be ACL-restricted (VC:L/SC:L); no integrity or availability impact. The primary limiting factor is that WikiLambda is a specialized, not-widely-deployed extension, and the flaw yields only minor disclosure.

This is a low-priority issue by every available signal. The vendor CVSS 4.0 base score is 2.9 (Low), driven by AV:N/AC:H with only VC:L and SC:L (a minor confidentiality impact on the vulnerable system and a subsequent system) and no integrity or availability impact. AC:H indicates the attack is not straightforward and likely depends on specific conditions or races. The CVSS exploit-maturity metric is E:P (Proof-of-Concept), which signals that a POC-level exploit exists per the vendor's own scoring - but there is no separate standalone exploit reference, no EPSS score provided, and no CISA KEV listing. There is no conflict between the network attack vector and the description: this is a web-facing MediaWiki extension, so AV:N is consistent. Net assessment: a genuine but minor ACL/permission-handling weakness (CWE-280) with limited disclosure impact and high attack complexity - not a widespread-exploitation priority. Missing data to note: no EPSS, no KEV, and no independent POC link despite the E:P maturity flag.

A remote, unauthenticated user interacts with the WikiLambda extension's API/UI and, under specific conditions, accesses a function or piece of functionality that should have been restricted by access-control lists, yielding limited information disclosure. The CVSS exploit-maturity flag (E:P) indicates a proof-of-concept exists, but high attack complexity (AC:H) means the access is not reliably reproducible against default state.