MediaWiki WikiLambda EUVD-2026-90199

Requires a valid authenticated account on a wiki running the MediaWiki WikiLambda (Wikifunctions) extension version 1.46 (PR:L). Exploitation targets a user-controlled key/identifier that the extension fails to authorize against the requesting user, allowing access to another user's or scope's objects. Limiting factors per the CVSS 4.0 vector: high attack complexity (AC:H), a specific attack requirement that must be present (AT:P), and passive user interaction from a victim (UI:P) - so it is not a one-shot unauthenticated exploit. The affected component is a specialized extension (Abstract Wikipedia/Wikifunctions), not standard MediaWiki, further narrowing exposure to wikis that explicitly install WikiLambda.

Signals are mixed and lean toward moderate real-world risk. The CVSS 4.0 vector (7.4) requires authentication (PR:L), high attack complexity (AC:H), a specific attack requirement (AT:P), and passive user interaction (UI:P) - four independent frictions that argue against trivial mass exploitation despite the network vector (AV:N). The vendor assigns full VC:H/VI:H/VA:H plus scope-change subsequent impacts (SC:H/SI:H/SA:H), which looks aggressive for a CWE-639 IDOR/authorization-bypass class issue; such flaws typically enable reading or altering objects belonging to other users rather than full host compromise. E:P (Proof-of-Concept exploit maturity) is asserted in the vector, but NO explicit POC is referenced and there is no EPSS score or CISA KEV listing provided, so there is no public exploit identified at time of analysis. The tag 'Authentication Bypass' conflicts with the actual CWE-639 (authorization bypass through user-controlled key) - verify with vendor whether this bypasses login or merely object-level access controls; the description echoes 'Authentication Bypass' but the weakness class indicates authorization/IDOR. Net: a genuine authenticated authorization flaw worth patching, but the AC:H + AT:P + UI:P + PR:L combination and the niche deployment footprint make it a moderate, not urgent, priority.

A low-privileged authenticated WikiLambda (Wikifunctions) user manipulates a user-controlled identifier/key in a request so the extension operates on an object or resource belonging to another user or scope they should not reach, reading or modifying it. Successful exploitation also depends on a specific condition (AT:P) and a victim performing a passive action (UI:P), and requires some setup (AC:H). No public exploit is identified, though the CVSS vector claims proof-of-concept maturity (E:P).