MediaWiki Collection EUVD-2026-89487

Exploitation requires the attacker to construct a URL targeting the MediaWiki Collection extension with an attacker-supplied external redirect destination, and critically requires victim interaction (UI:R) - the target must click or follow the crafted link, which bounds this to social-engineering/phishing delivery rather than autonomous exploitation. It affects installations running the Collection extension at versions before 1.46.1, 1.45.5, or 1.43.10; wikis that do not have the Collection extension installed and enabled are not exposed. No authentication is required (PR:N), so any unauthenticated attacker can generate the malicious link, but no impact occurs without the user action.

This is a moderate-severity open redirect (CWE-601) carrying a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable, low complexity, no privileges, but requiring user interaction (the victim must follow a crafted link). The EPSS score is very low at 0.14% (3rd percentile), it is NOT listed in CISA KEV, and there is no public exploit identified at time of analysis, so all exploitation signals converge on low real-world urgency. This is a classic high-is-relative, low-real-risk issue: open redirects rarely yield direct compromise and are typically chained into phishing or OAuth/token-theft flows rather than exploited standalone. The changed scope (S:C) and low confidentiality/integrity impacts reflect that the trust boundary crossed is the user's perception of the destination, not the MediaWiki server itself. No signals conflict; the picture is consistent across CVSS, EPSS, and the absence of KEV/POC. Priority should be routine patching rather than emergency response.

An attacker crafts a malicious URL pointing at a vulnerable MediaWiki Collection extension endpoint that includes an attacker-controlled redirect target, then delivers it via phishing email or a wiki page. A victim who trusts the wiki domain clicks the link, the Collection extension redirects their browser to an attacker-controlled site, and the attacker harvests credentials or serves malware under the guise of the trusted wiki. No public exploit is identified at time of analysis, and success depends on the victim clicking (UI:R).