CVE-2026-96872
WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
- Published
- Sep 23, 2026
- Updated
- Sep 23, 2026
- Assigning CNA
- wikimedia-foundation
- Evidence observed
- Nov 4, 2026
Primary CVSS
cvelist · CVSS 4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/AU:YLow · next 30 days
- Percentile
- 28.3%
- Model date
- Nov 4, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.
Sources
Report and proof-of-concept for CVE-2026-96872, an unsaved-code authorization bypass in WikiLambda, with validation notes and upstream patch references.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.