EUVD-2026-87361Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege wiki user
-
ExploitSend request to ACL-unconstrained Translate endpoint
-
ExecutionPerform action bypassing missing authorization check
-
ImpactModify translation content without rights
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on a MediaWiki installation that has the Translate extension enabled (PR:L, AV:N, no user interaction). The attacker must reach a translation-management function whose server-side ACL enforcement is missing, so exploitation is limited to environments where the Translate extension is installed and the attacker can obtain any registered low-privilege login. Impact is confined to integrity (VI:L) - no confidentiality or availability effect - and installations on 1.46.1, 1.45.5, or 1.43.10 and later are not affected. |
| Impact | This is a genuine-but-low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, base 5.3 Medium) describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privilege account (PR:L) and yields only limited integrity impact (VI:L) with zero confidentiality or availability impact - consistent with a missing-authorization (CWE-862) defect where an authenticated user reaches translation functionality not properly constrained by ACLs. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active or automatable exploitation; the only external evidence is a Wikimedia Phabricator task and a Gerrit patch, indicating a fixed, vendor-tracked bug rather than an emergent threat. Exploitation status is therefore 'no public exploit identified at time of analysis.' The one notable inconsistency is the 'Authentication Bypass' tag: the CWE-862 classification and PR:L vector indicate an authorization (access-control) failure by an already-authenticated user, NOT an authentication bypass - the tag is misleading. Net: a real Medium-scored authorization gap worth patching in normal maintenance cycles, not an urgent emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on a wiki running the Translate extension invokes a translation management action (page/message-group operation) that the UI would normally restrict, because the server does not re-check the caller's ACL rights. This lets them modify or manipulate translation data they should not be able to change (integrity impact). No public exploit code was identified, and the flaw requires a valid authenticated session, limiting opportunistic abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Missing authorization checks in the MediaWiki Translate extension let any logged-in user with network access invoke translation-management functionality that should have been constrained by ACLs, affecting installations running versions prior to 1.46.1, 1.45.5, and 1.43.10. The impact is confined to integrity - an authenticated low-privilege attacker cannot read protected data or cause a denial of service - giving a CVSS 3.1 base score of 5.3, and no public exploit code has been identified at time of analysis. Exploitation requires a valid registered account on a wiki where the Translate extension is enabled, so exposure is limited to those deployments.
RemediationAI
Vendor-released patch: upgrade the Translate extension to 1.46.1, 1.45.5, or 1.43.10 (matching your MediaWiki branch), all of which contain the missing authorization enforcement; the fix is tracked in Gerrit change I9b74c849b223f18955b42779f5ffbd1e051e415c and Phabricator task https://phabricator.wikimedia.org/T433070. Until the upgrade can be applied, restrict the Translate extension's translation-management rights (for example, review which groups hold translation-administrator or equivalent permissions and remove them from untrusted accounts) and reduce the number of accounts that can log in, accepting that this degrades normal translation workflows and may not fully close the gap because the authorization check is server-side and missing rather than configurable. If translation functionality is not required, disabling the Translate extension eliminates the attack surface at the cost of losing multilingual content features entirely. Because exploitation requires only a low-privilege authenticated account, monitoring for unexpected grants of translation-management permissions or unusual translation-review actions can provide a compensating detection control, though it does not prevent the integrity impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Translate extension is a widely used MediaWiki add-on that provides an interface for translating wiki pages, managing message groups, and reviewing translations. The flaw is classified as CWE-862 (Missing Authorization), meaning the server-side ACL/permission check that should gate a translation-management action was absent, so an authenticated user could reach functionality intended only for users holding translation-administrator rights. The affected component is identified by CPE cpe:2.3:a:wikimedia_foundation:mediawiki_-_translate_extension:*:*:*:*:*:*:*:*, with the vendor-resolved branches being 1.46.1, 1.45.5, and 1.43.10. The associated Gerrit changeset (I9b74c849b223f18955b42779f5ffbd1e051e415c) and Phabricator task T433070 track the remediation, which adds the missing permission enforcement to the affected code path. No specific CVE mapping to a particular API module or special page is given in the available sources, but the root cause is a server-side authorization gap rather than an injection, memory-safety, or cryptographic defect.
Know when Mediawiki Translate Extension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable and low-complexity, but requires an authenticated low-privilege account (PR:L) and yields only limited integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB