EUVD-2026-87358Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify MediaWiki with WikiLambda extension
-
ExploitSend crafted request to exposed endpoint
-
ExecutionServer returns sensitive information
-
ImpactHarvest disclosed data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a MediaWiki installation running the WikiLambda extension at version 1.47.0-alpha (the extension that powers Wikifunctions/Abstract Wikipedia). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required - an unauthenticated remote attacker can trigger the disclosure against a default-exposed instance. The primary limiting factor is deployment scope: WikiLambda is an uncommon extension installed on very few sites, and the impact is bounded to LOW confidentiality (a limited amount of information), with no integrity or availability effect. |
| Impact | The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) describes a network-reachable, unauthenticated, low-complexity information disclosure with only LOW confidentiality impact and no integrity or availability impact. The CWE-200 classification and the 'Excavation' attack pattern (CAPEC-116) indicate an attacker extracts a limited amount of sensitive data by probing exposed responses rather than achieving code execution or takeover. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no public exploit identified at time of analysis. The realistic priority is LOW-to-MODERATE: while the flaw is unauthenticated and remotely reachable, the impact is confined to disclosure of a small quantity of information (VC:L), and the affected component is a niche MediaWiki extension. The only fix reference is a Gerrit patch merged to the master branch with no tagged release version, which slightly complicates remediation planning. This is a genuine but low-impact issue, not a high-severity emergency; the 6.9 score is driven by unauthenticated network reach rather than by the severity of the outcome. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends crafted requests to a MediaWiki instance running the WikiLambda extension (version 1.47.0-alpha) and receives responses that expose sensitive information not intended for public view. No authentication or user interaction is required, but only a limited amount of data is disclosed. No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated information disclosure in Wikimedia Foundation's WikiLambda Extension 1.47.0-alpha allows remote attackers to access a limited amount of sensitive data from affected MediaWiki installations. The issue is CWE-200 exposure of sensitive information, with a CVSS 4.0 base score of 6.9 (low confidentiality impact only and no integrity or availability impact); the independent assessment confirms network reachability with no authentication or user interaction. No public exploit identified at time of analysis, and the upstream remediated code is on the master branch via Gerrit change 1320186, tracked in Phabricator T430601.
RemediationAI
Apply the upstream fix from Gerrit change 1320186, which was remediated on the master branch; if running WikiLambda Extension 1.47.0-alpha, upgrade to a build that includes that change or later master. Patch status is upstream fix available (PR/commit); released patched version not independently confirmed, so track https://phabricator.wikimedia.org/T430601 for vendor guidance and confirm your deployed build contains the fix. If WikiLambda is not required, disabling or uninstalling the extension removes exposure but sacrifices Wikifunctions/Abstract Wikipedia functionality. If the extension must stay enabled and the patch cannot be applied immediately, restrict access to the MediaWiki instance to trusted networks or authenticated users as a compensating control, understanding that this breaks public wiki access and is only a risk reduction, not a fix. No specific configuration flag or vendor patch version string is provided in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WikiLambda is the MediaWiki extension that supports Wikifunctions and Abstract Wikipedia, adding wiki-native function definition and evaluation capabilities. The CVE is CWE-200, meaning sensitive information is exposed to an unauthorized actor, but the exact code path is not detailed in the provided references; the public CPE cpe:2.3:a:wikimedia_foundation:mediawiki_-_wikilambda_extension:*:*:*:*:*:*:*:* identifies the Wikimedia Foundation MediaWiki WikiLambda Extension package, and the description pins affected code to 1.47.0-alpha. Per the supplied CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N, the flaw is network-reachable, low-complexity, and unauthenticated, but only confidentiality is impacted (VC:L, VI:N, VA:N); independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The fix was landed on master, indicating the vulnerability is in extension code rather than core MediaWiki.
Know when Mediawiki Wikilambda Extension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network access with low complexity and no user interaction yields a partial confidentiality-only disclosure, so C:L with I:N/A:N and S:U.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
DescriptionCVE.org
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation.
This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Authorization bypass in the MediaWiki WikiLambda (Wikifunctions) extension version 1.46 lets an authenticated wiki user
Authentication bypass in the Wikimedia Foundation's WikiLambda extension for MediaWiki allows unauthenticated remote att
Stored cross-site scripting in the Wikimedia MediaWiki WikiLambda extension (the software behind Wikifunctions / Abstrac
Information disclosure in the MediaWiki WikiLambda extension - the software behind Wikifunctions - before version 1.47.0
GitHub PoC
Exploit-DB