MediaWiki CentralAuth EUVD-2026-90075

Exploitation requires HIGH privileges (PR:H) - control over a CentralAuth configuration/system setting - meaning the attacker must already be a trusted operator or hold a compromised administrative account; it is not reachable by anonymous users. The vendor vector also marks a present attack requirement (AT:P) and passive user interaction (UI:P), so a victim request or session must traverse the vulnerable code path, and high attack complexity (AC:H) implies non-trivial preconditions. It specifically affects deployments running the CentralAuth extension (versions 1.43, 1.45, 1.46) - typically multi-wiki/wiki-farm SSO setups rather than standalone single-wiki MediaWiki installs. The scope change (SC:H/SI:H) means successful injection can affect federated wikis beyond the initially controlled component.

This is a real but conditions-gated, lower-urgency issue rather than a mass-exploitation threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:P) explicitly stacks multiple friction factors: high attack complexity, a present attack requirement (AT:P), HIGH privileges required, and passive user interaction - so despite being network-reachable, exploitation is far from trivial and cannot be done by an anonymous attacker. The CWE-15 (external control of a configuration setting) leading to Code Injection, combined with the scope change (SC:H/SI:H) in the vector, indicates that an actor who already controls a privileged configuration/interface can inject code that impacts systems beyond the immediate one - meaningful in a multi-wiki farm where CentralAuth federates identity. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The E:P (Exploit Maturity: Proof-of-Concept) sub-metric in the vendor's 4.0 vector hints the vendor considers a PoC-level exploit conceivable, but that is a maturity estimate, not confirmed weaponization. Net: prioritize patching where CentralAuth is deployed, but the PR:H + AC:H + AT:P + UI:P gating places this below internet-facing unauthenticated RCEs in urgency.

A highly-privileged actor (e.g., a wiki-farm operator or compromised administrative account able to control a CentralAuth configuration setting) supplies attacker-influenced configuration input that CentralAuth later interprets as executable code. When a victim's request or session passively triggers the affected code path, the injected code runs, and because of the scope change, the impact can extend across the federated wikis served by CentralAuth. No public proof-of-concept exploit was provided in the available intelligence.