bombobombone/cve-2026-96872Report and proof-of-concept for CVE-2026-96872, an unsaved-code authorization bypass in WikiLambda, with validation notes and upstream patch references.
Reporter: Marco Paciaroni (BomboBombone).
WikiLambda did not apply its unsaved-code authorization rules throughout nested function data. An anonymous caller could cause unapproved source code to cross the permission boundary and reach the configured function evaluator.
The CVE record identifies WikiLambda versions before 1.47.0 as affected.
The issue requires WikiLambda and a configured function orchestrator/evaluator. It bypasses the permission governing submission of unsaved code. The evaluator uses WASM isolation; the finding does not establish execution on the MediaWiki host or a sandbox escape.
The original report records a controlled local comparison using a capture service. A request that should have been rejected was forwarded across the authorization boundary. This established unauthorized code submission; the capture service did not execute host commands.
The upstream change makes unsaved-code detection inspect nested objects and lists. Authorization must account for code throughout the submitted structure before forwarding a request.
python poc.py --api http://127.0.0.1:4000/api.php
The local test wiki must point its WikiLambda orchestrator at the loopback capture service started by the script. The PoC compares the rejected control with the nested Z825 request and uses a harmless returned marker.